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Introduction TSCM Intro 

The following information is a guideline to various espionage threats; the recommendations on 
how to start up a TSCM Team linked to Training Courses for all different user levels, and 
recommendations for products that have proven their reliability & competence, and which are 
used by various government sweep teams around the world. 



The search efficiency of a sweep team is of paramount importance. Government statistics 
show that the manpower used in a TSCM sweep is divided according to the following 
percentages: 



Physical Search 


35% 


Cable Measurement 


30% 


Radio Frequency Measurement 


10% 


ISDN Phone System Checks 


10% 


Anti Hacking Manipulation 


15% 



One of the many misconceptions is that most inexperienced personnel presume the biggest 
espionage threat is from wireless bugs. However, this is NOT the case: cable and software 
manipulation are the most common targets for intelligence-gathering operators. 



The key to creating a successful Sweep Team is not simply buying all the top equipment on 
the market, but rather using a systematic, logical, and efficient approach: 



1- Identify the Threat of Surveillance Equipment 

2- Set Up and Manage a TSCM Team 

3- Implement Technical and Management Training 

4- Review the range of sweep products 

5- Set up a TSCM workshop 

6- Repeat the above skills 

7- Establish an IT network test procedure 

8- PABX administration training. 
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Introduction TSCM Intro 

At our TSCM workshop facilities in Germany we can introduce you to the above detailed 
program. During a 1- to 2-day seminar we can show you the tactics of our sweep teams and 
the equipment used in sweep operations (an investment well over one million Euros). The 
follow-up training programs, which last 2-3 weeks, are given by the most advanced and 
renowned TSCM sweep engineers in different fields. We can also carry out an audit of your 
available sweep team and provide technical operational training on any equipment you already 
have. 

If you require any further assistance please do not hesitate to contact us. 

TSCM SWEEP 
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Strategic Security Overview Overview 

Within today's global environment, strategically sensitive information has the potential to 
damage or destroy your interests both domestically and abroad. 



Leaked or illegally obtained information, while of great value to the 
beneficiary, can damage the strategic interests of the organization 
from where it was obtained, if acted upon effectively by a competitor 
or opportunist. Although this represents a serious breach of security 
in the short term, what is potentially damaging in the long term, is the 
loss of initiative including the resultant loss of confidence in that 
organization as a "safe and secure pair of hands". 



It is not 
uncommon for 
espionage to be 
an ongoing, 

undetected and a 
draining aspect of 
business life 



Whilst individuals condoning and conducting such information gathering are engaging in highly 
illegal and dangerous activity, the tangible benefits of doing so often outweigh the risks; as 
such activity is seldom detected if not effectively monitored. It is not uncommon for 
espionage to be an ongoing, undetected and a draining aspect of daily life. 



Most countries 
can expect 
attacks from 
espionage 
specialists 



It is a National responsibility to undertake reasonable, realistic and 
practical precautions to deter or counteract unscrupulous parties. To 
reduce exposure to this invisible, yet tangible threat, is an act of due 
diligence. 



Most countries may reasonably expect to receive the attention of Espionage or Surveillance 
specialists operating on behalf of their clients. These will range from competitors to 
opportunists to foreign governments, all looking to further their own ends. 



How is sensitive information obtained? 

There are two main methods: 



The first method is via a human resource, preferably a person already in a key position within 
the target organization. Whilst the recruitment or placement of a live asset is the preferable 
option, it is also the most time consuming, complex and expensive. Typically, recruitment 
agents (or "handlers") will meet the identified target already in place, either directly or through 
a third party. The handler will proceed to profile the target individual for areas of strength, 
weakness, preferences etc ("face time") and form an assessment. This assessment will range 
from psychological to financial. Should the assessment be favorable, the handler will then 
probe areas of personal weakness with a view to expanding them, whilst at the same time, 
encouraging areas of empathy, thereby placing him/her in the position of an increasingly close 
confidant. The objective is to cement a relationship that will ripen for exploitation. This 
technique is often referred to as "hooking". 
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Strategic Security Overview Overview 

The second method is a leap forward in sophistication, which is electronic surveillance. The 
placement of listening devices in key areas such as offices, boardrooms, telephone lines and 
homes can reveal a wealth of information. Not only is this about tangible business plans and 
the practice of any organization, but also, the quality of the dynamics and relationships within 
those organizations. Clearly, any "hooking" operation may well begin with electronic 
surveillance. Whilst it is time consuming to transcribe and analyze the recordings, this is a 
quick, clean and easy way to access and analyze proprietary information. 



Equally valid, although it excludes the human context, is accessing databases through 
"hacking". Hacking may be used either to gather information or sabotage electronic systems 
by inserting logic bombs, viruses etc. Most organizations contact the outside world via 
telephone lines and can be contacted in return. Electronic "gatekeeper" and "firewall" 
systems are now considered standard amongst most organizations as this form of access 
violation usually surfaces and consequently the threat becomes tangible, understood and 
counteracted. 



For an insignificant fee, when compared to the potential gain, it is 
not difficult to find an agent who will arrange to have listening 
devices installed. These agents will range from private security 
companies (often former government employees) to telephone 
engineers to private investigators. This type of surveillance goes 
on day in and out with highly sophisticated equipment, light legal 
penalties, and instigators normally two or three parties removed 
from the scene. Consequently, from the point of view of the 
predator, there are strong motives, ample means and a very good 
chance of not being caught. 



This is a dilemma 


faced by many 


and 


consequently it 


is 


more difficult 


to 


defend against 


this 


form of attack than to 


instigate it. 





If someone is stealing your laptops, you know; however, if someone is analyzing the strategy 
and fabric of your organization you may not truly know, even if you may suspect. In short, how 
do you know if you are losing strategically sensitive information through an invisible medium? 
This is a dilemma faced by many. Consequently, it is considerably more difficult to defend 
against this form of threat than to instigate it. 



How do I know or find out if I am a target? 

Assume that you are. As already discussed you may be targeted in different ways. It would be 
a major undertaking to constantly monitor and investigate all methodologies, and probably only 
warranted in exceptional circumstances. However, it would be safe to say that if you are 
being targeted, you have been or are almost certainly being bugged. Consequently, a sweep 
of sensitive areas and phone lines would be the most efficient, cost effective and appropriate 
way forward. 



A sweep, which many view as a standard service, alongside office cleaning and fire/access 
system maintenance, can be conducted at any time, either at night, during a sensitive in-house 
or off-site meeting in cars or even airplanes. This provides either immediate reassurance or 
tangible evidence of espionage activity. 
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Strategic Security Overview Overview 

What do I do if I am being bugged? 

First, tell no one. Assemble a trusted TSCM management team. 

A variety of options are available, which may include running a disinformation campaign or 
surveillance operation, further investigation, removing the device or 
apprehending/investigating the technician/employee suspected of placing the device. 

The business activities and climate at that time, combined with the quality of the device, 
(which gives an indication of the sophistication and funding behind the hostile party), are likely 
to dictate the appropriate course of action. 
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The Threat 

THE THREAT 



Technical Trends 


1-18 


Communication Monitoring 


19-23 


Wire Tapping 


23-26 


TSCM Sweeps 


27-40 


Software Manipulations 


41-49 


ISP Manipulations 


49-54 



TRENDS AND TYPICAL RISKS 
FACING A TSCM TEAM 
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The Threat 



State-of-the-art technologies 
of technical espionage 
and counter-measures 



Speaker: Franz-Josef Schauka, 
former captain and team-leader TSCM 
of the German Military Intelligence (MAD) 



Overview 

Room monitoring 

• Miniaturizing 

• Camouflage 

• Technical trends 

Telecommunication monitoring 

• Interception and wire tapping 

• Software manipulations (PBX course only) 

Countermeasures 

• Risk analysis and Prevention 

• TSCM Sweeps 

Demonstrations 
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1- Room Monitoring 



Room Monitoring 
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The Threat 



Room Monitoring 

■ Methods 

• Using miniaturized bugs 

• Using highly sophisticated unconventional camouflage 

• Using high-end transmission technologies 

• Manipulation of existing devices 



Miniaturizing 

■ Surface Mounted Devices (SMD-parts) 

• Consequences of using of SMD-parts 

• Industrial manufacturing of circuit plates by machines 
large number of bugs 

• Low cost, high integrated components 
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The Threat 



Miniaturizing 




Camouflage 

■ In or as harmless items 

• Walls, wall panels, hollows, (e.g. hanging ceilings, 
double floors, built-in furniture) 

• Solid-seeming material (e.g. wood, metal) 

• Insignificant objects (e.g. pasteboard, door-stop) 

• Decorations (e.g. paintings, flowers) 
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The Threat 




Camouflage 

■ As articles of daily use 

• Desk-items (e.g. stamp, paper clip box, mouse pad, 
ashtray) 

• Writing utensils (e.g. pen, high-lighter) 

• Personal Items (e.g. Mobile, gas-lighter, clothes!) 
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Camouflage 
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The Threat 



Camouflage 




Camouflage 
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The Threat 




Camouflage 

■ In electrical devices 

• Mobile phone accumulators and chargers, telephone and 
mains adapter and plugs, light switches 

• Motion and smoke detectors, air conditioning control 
systems 

• Desk items (e.g. calculators, desk lamps, radios) 

• Communication systems (e.g. fax machines. Pc Cameras). 
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Camouflage 
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The Threat 



Technical Trends 

■ Sophisticated technologies of control 

• Voice control (VOX) is standard today 

• Radio control of all parameters (e.g. ON-OFF, power and 
frequency) 

• Remote power ON-OFF ("passive bugs") 

• Control by timer or sensors 
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Technical Trends 




Technical Trends 



■ State-of-the-art methods of transmission 



• Using high-end standard procedures and protocols (GSM, 
DECT, Bluetooth, W-LAN) 

• Misuse of highly available ISM and LPD standard 
components (e.g. walkie-talkies and telemetry 
transmitters) 

• Misuse of high-end methods of wired transmissions (e.g. 
fiber-optics, ISDN and LAN wiring) 
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The Threat 



Technical Trends 

■ Manipulation instead of installation 



• Misuse of existing systems (e.g. phone systems, PCs, 
intercoms and loudspeaker systems) 

• Modification of common electric devices (e.g. telephones, 
office machines and multimedia systems) 
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Technical Trends 



Technical 

Trends 
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The Threat 



Technical Trends 



■ Receiving of unintended emanations 

• Reproducing of compromising emanations of PC 
components (e.g. graphic board, monitor, printer, 
keyboard) 

• ATTENTION: The emanation of TFT flat screens is 
stronger than the emanations of visual display units with 
conventional tubes! 
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Telecommunication Monitoring 

■ Risks from international calls 

• Monitoring of microwave-transmissions 

• Monitoring of the communication satellites 

• Monitoring of national and international telephone-wires 
(incl. sea-cable and fiber optic wires) 



Telecommunication Monitoring 
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Telecommunication Monitoring 



Telecommunication Monitoring 
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Telecommunication Monitoring 
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The Threat 



Telecommunication Monitoring 
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The Threat 




Wire Tapping 

■ Sources of danger 

• Public networks (PSTN) 

• PBXs and distribution boxes 

• All telephone wires 

• Telephone plugs and adapters 

• Telecommunication devices (telephones, fax and 
answering machines, modems) 
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Wire Tapping 




Wire Tapping 
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Wire Tapping 
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The Threat 




TSCM Sweeps 

■ Physical search 

• Manual opening of all hollows (screwdriver) 

• Visual inspection (mirrors, lights) 

• X-ray inspection of all items 

• Using optical endoscopes and video endoscopes for 
inaccessible hollows 
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TSCM Sweeps 




TSCM Sweep 
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TSCM Sweeps 

■ ISDN phone system checks 



• Checking 

• Checking 

• Checking 

• Checking 

• Checking 



the configuration of the features 

for warning-tones 

the remote access 

for default users and passwords 

Log files 



TSCM Sweep 



Command: list hist 
list history 

HISTORY 

Date of Loaded Translation: 12:00 am Sat Aug 19 r 2 COO 



Date 


Time ] 


Port 


Login 


Actn 


Object 


Qualifier 


11/01 


15:28 


NET 


sciboz 


add 


station 


HOD 


11/01 


15:22 


NET 


sciboz 


cha 


station 


170 D 


11/Q1 


15:17 


NET 


tis 








11/01 


15:03 


NET 


sciboz 


chaT 


vector 


117 


11/01 


15:00 


NET 


sciboz 


dup 


station 


1999 


11/01 


15:00 


NET 


scitaoz 


add 


dup-stn 


6599 


11/01 


15:00 


NET 


sciboz 


rem 


station 


6559 


11/01 


15:00 


NET 


scitaos 


dup 


station 


1996 


11/01 


15:00 


NET 


sciboz 


add 


dup-stn 


5586 


11/01 


14:59 


NET 


scitaoz 


dup 


station 


19 9” 



press CANCEL to quit -- press NEXT PAGE to continue 
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The Threat 



2- Typical Risks 



Typical Risks 

■ Weak points of the construction 

• Placing the distribution boxes in cleaning rooms 

• Placing the PBX in critical rooms on the ground floor 
(direct to public areas) 
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The Threat 



Typical Risks 

■ Organizational mistakes 

• Missing documentation about the telecommunication 
wiring 

• Storing the documentation with names, room and 
extension numbers in the distribution boxes 



Typical Risks 
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The Threat 




Typical Risks 

■ Organizational mistakes 

• Uncontrolled access to ISDN test-equipment of the service 
staff 

• Using the memory of fax machines without periodical 
checking the stored numbers 



CONFIDENTIAL 



33 



elaman P 



OF*u*N KtUlITT igiUTIDNI 



o 



The Threat 



Typical Risks 

■ Measurement and 
Test Equipment 




Typical Risks 
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The Threat 



Typical Risks 

■ Organizational mistakes 

• Outsourcing of all services in the telecommunication 
(e.g. wiring, installation, administration, service) 

• Missing possibility to check the outsourced service 



Typical Risks 

■ Technical weak points 

• Technical rooms and distribution boxes are not 
consequently locked (e.g. using standard locks like RITTAL 
3524 or DIRAK 1333) 

• Common use of the distribution boxes for 
telecommunication, data network, access control, 
intrusion- and fire-alarm systems 
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Typical Risks 
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Typical Risks 
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The Threat 




Typical Risks 

■ Technical weak points 

• Outsized new wiring (surplus cable or wires) 

• Unnecessary Patches in case of structured wiring (e.g. 
CAT-5) 

• Missing encryption systems for critical telecommunication 
transmissions (voice, fax and data) 
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Typical Risks 
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The Threat 



Typical Risks 

■ Technical weak points 

• Digital phones with hands-free-answer-back in critical 
rooms (e.g. of board members) 

• Telephones (as well as analog) in conference rooms 

• Using cordless phones (especially of former generation 
which can easily be monitored) 




Typical Risks 



CONFIDENTIAL 



40 




elaman P 



5F»U*N KtUlITT igiUTIDNI 



. o 



The Threat 



3- Software Manipulations 



Software Manipulations 

■ Reasons for possible manipulations 

• Manufacturers are ignoring the security risks of their ISDN 
systems (some install "backdoors") 

• Administrators have no awareness of existing security 
risks (e.g. by using remote access) 

• Users of ISDN systems permanently ask for new technical 
features, without thinking about risks 

• Software manipulations by specific attacks (by "methods 
of hackers") 
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The Threat 




Software Manipulations 

■ Kind of manipulations 

• Manipulation and misuse of regular features (e.g. hands- 
free answer back or "virtual" conferencing) 

• Activation of hidden features (e.g. witness function, 
service observing or "lawful" interception) 

• Adding new self-created features (own programs) to the 
PBX 
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Software Manipulations 

■ Misuse of regular features 
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Page 
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Software Manipulations 

■ Misuse of regular features 



display system-parameters features Page B of 9 

FEATURE -RELATED SYSTEM PARAMETERS 



SERVICE OBSERVING 
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d i sp 1 ay s y s tern-pa r ame te r s f ea tu re s 



CONFIDENTIAL 



43 



elaman 

NH V / 



OF*u*N KtUlITT igiUTIDNI 



The Threat 



Software Manipulations 
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Software Manipulations 

■ Export Features 

KOEGLICHE WERTE ; AMTFANG 



LEDSIGN 

VMSXWV 






RELCON 


yicmm 




RERING 


( (CHINA 


LM) 


AOTOV 

Nomur 

NOTTR 


V (CHINA 


LM), 
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The Threat 



Software Manipulations 
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Software Manipulations 

■ Lawful Interception 
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Software Manipulations 

■ Implementing of Own Scripts 



01 



02 


goto 


step 


ID 


if 


ani 


in 




table 


10 




03 


goto 


step 


T 


ir 


UDGcmcU t La i ja 1 1 v 










04 


gi a to 


step 


ID 


if 


tlme-pf-day 


is 


rtl 


17 i 30 


to. man 


□ 8 : DO 


05 


guto 


step 


ID 


if 


tinw-of-doy 


is 


all 


IS; DD 


to fill 


DD ; 00 



Db 

07 wait- time 15 sees heating music 
OB 

09 

10 route -to ruLroii>e=r 717 no wltV: gov n If nneiEdltlanally 



Software Manipulations 

■ In videoconfere 

■ 

■ 

■ ncing systems 

• Activating of the "auto answer mode" is the most 
common mistake (Reason: The system must be usable for 
board members) 

• Often no ringing tone is configured 

• Most effective method of protection is a mains switch for 
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Software Manipulations 
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Software Manipulations 




Software Manipulations 
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Software Manipulations 




Mart Volume (O' 
Alert St»*ir: 
Pisvbus Menu 



Alert T«Mt ft Volume 
Mdto Call 
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The Threat 



WAN-LAN Access 



■ Problems 

• Continuous fast increasing fusion between 
telecommunication and IT 

• Internal "remote" Administration of the own PBX by LAN) 

• Increasing IP-telephony 

• LAN-access possible in case of wrong configuration 




remote- 
PC with 
ISDN- 
board 




WAML- 

board 
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WAN-LAN Access 




rear sade: 



by sy stem bos 
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WAN-LAN Access 

■ Unused Firewall 



GLOBAL PARAMETERS 



WAHL STATION NriMF-EP: KOI 



SYSTEM TYPE: 


ETCOH 


RWBBP OF B-CEffiNNET 5, ; 






BYTE PATE: 


ion kbasec- 


PACKAGE 3ATT-; 


1000 


1 PEP 


CALL PKTRIES 


3 


CALL pause : 


s 


SECr 


KI0H MATER MARK ■ 


SD 4 


ABB CHW4WTX TIMER i 


40 


SECT 


LOW HAT FTP. MARK: 


es ^ 


■™ TTHER : 


3D 


J5IC. 



V I Pj iWfiJ J. : 

JL'-lUu -Iljimp iiiiiULi- EJIt_L 



TRACE -LEVEL: 3 

LAW Cffl - LWTliRTACE ; WESZEaff 
ALP JRCEsS VIA ISDH D3IERTACIS: ROOTE 
ALP ACCESS VIA EJiTERHAl Lm ISFEHKAjCES: fflOOTE 



:ul?ti isotf 



ARE HO DATA CONFINED TFT TABLE 'FTRlT 
PE All: Mi' DATA COHTIGORED IN TABLE FTREMA.CV 




WAN-LAN Access 



Hi P alii IGOGA^iitam: 

BrU I *.«**# JiR mi'M‘1 
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Thank for your Time 

Elaman GmbH 
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Recommendations 



Sweep 



RECOMMENDATIONS FOR A GOVERNMENT SWEEP TEAM 



We recommend the following steps be taken to set up, equip and manage a government 
Sweep Team. The recommendations were made after close cooperation with the German 
Government. 



1 . Recommendations 



Recommendations for future development of skills and equipment 



• Teach the basic TSCM skills or repeat TSCM skills already learned 

• Coordination within the Sweep Teams 

• Start a small workshop for the counter-teams 

• Set into place management pre-planning protocols and reporting methods 

• Emphasize cable measurement and security 

• Set into place assessment protocols of areas to be swept 

• PABX Manipulation & anti-hacking protocols 



2 . Equipment 

For a more successful team and sweep results, additional equipment, especially for the 
physical search and cable measurement, is needed. 



3 . Aim of the Sweep Team 



• To make all rooms for Government meetings free of surveillance systems 

• To make sure the system and search procedures detect and render harmless 
surveillance products such as: 

- - Audio bugs; all frequencies and modulations 

- - Video cameras and transmitters 

- - Microphones; wired analog and fiber optic 

- - All cable based surveillance equipment 

- - Telephone, e-mail and fax monitoring systems 

- - All surveillance equipment installed in shredders, walls etc. 

- - GSM phones used as surveillance phones 

- - PABX manipulation 

- - IP hacking 



CONFIDENTIAL 



1 



elaman 

NH V / 



01*1*4* (KUIITlf igiUTIDNI 



Recommendations Sweep 

TRAINING PACKAGE 

The most important part of a successful Sweep Team is the initial training and management 
set up. We offer below a complete management set up including operational, technical and 
management training. We will make available specialist sweep engineers and managers to 
teach the use of equipment and how to set up a Sweep Team. 



4. Training 



Schedule 




Duration 


Stage 1- 


-Training in Europe at our TSCM Laboratory on how to manage and 
organize a Sweep Team including training on all technical threats 
and solutions 


2 Weeks 


Stage 2- 


-Training in the threat of PABX-ISP manipulation and how to test 
and protect yourself against such attacks 


2 Weeks 


Stage 3- 


-Proposals for equipment based on turnkey product selection 


2 Weeks 


After Purchasing Equipment 


Stage 4- 


-Operational Training on the equipment in Germany (acceptance) 


2 Weeks 




-Advanced training focusing on cables (Germany) 


1 week 




-Repetition of theory, background and updating technologies 
-PABX administration training 


2 weeks 


Stage 5- 


-Training in end-user country - A 


2 Weeks 




-Training on equipment and usage taking into consideration the end- 
user's conditions 






-Review of management and coordination techniques 




Stage 6- 


-Training in end-user country - B 






-Follow-up training on products and search techniques within 6 
months from the last training and again 1 2 months 


1 Week 




-Focusing on the warranty of the products 



5. Management 

• Establish planning documentation and protocols 

• Establish equipment check list 

• Establish service and test checks 

• Establish sweep area profile 

• Establish transportation and storage system 

• Establish regular update of new technologies 

• Have good selection of training courses, both technical and operational 

• Establish your own sweep workshop 
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Recommendations Sweep 

DIAGRAM 1 
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Recommendations 

DIAGRAM 2 



Sweep 



C Listening Post & 
External 
Surveillance 



C Entry & 

Evacuation ) 
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TSCM Course List 



Training 



TSCM Training COURSE overview 


Course 

No. 


Course name 


Duration 


Location 


Number of 
students 












8000 


TSCM Search and Technical Course 


2 weeks 


Germany 


6 students 


8001 


TSCM Advanced Cable Course 


2 weeks 


Germany 


6 students 


8002 


TSCM Senior Management Course 


1 week 


Germany 


4 students 


8003 


TSCM Technical Threat Course 


1 week 


Germany 


6 students 


8004 


TSCM Product Training Course 


2 weeks 


Germany 


6 students 


8005 


PBX Manipulation Course 


1 week 


Germany 


6 students 


8006 


PBX Advanced Manipulation Course 


1 week 


Germany 


8 students 


8007 


PBX Senior Engineer Course 


2 weeks 


Germany 


6 students 


8008 


Anti-Hacking Course 


1 week 


Germany 


6 students 


8009 


ISP Manipulation Advanced Course 


2 weeks 


Germany 


6 students 


8010 


TSCM Threat Assessment 


1 week 


customer 


6 students 


8011 


TSCM Sweep Team Review 


1 week 


customer 


No limit 


8012 


TSCM Equipment Audit 


1 week 


customer 


No limit 


8013 


TSCM Product Training Course 


2 weeks 


customer 


No limit 


8014 


PBX-ISP Penetration Assessment 


1 week 


customer 


6 students 


8015 


PBX Turnkey Service Support 


1 year 


Varies 


individual 


8016 


TSCM Sweeping of Cars 


1 week 


Germany 


4 students 


8017 


Computer Forensics 


1 week 


Germany 


4 students 


8018 


TSCM IT Course 


1 week 


Germany 


4 students 
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Course Offer 



PROPOSAL FOR A 2-WEEKTSCM COURSE 




TSCM TEST ROOM 



LOCATION: TRAINING INSTITUTE AND END-USER LOCATIONS 
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Example of a TSCM Course Offer Course Offer 

TSCM TRAINING COURSE 

Duration: 2 Weeks 

Qualifications: On the successful completion of the course, all students will receive a 
certificate including an individual assessment. 

Student Group: The course has been designed for Government Security Agencies 
responsible for managing and carrying out Technical Surveillance sweeps. The technical level 
of the course is tailored to each individual group. Specific threats concerning the students can 
be incorporated into the course. The training is designed for 6 people. 

Aim: To up date and manage a Sweep Team with an introduction to all forms of technical 
espionage; the art of carrying out a sweep, including search and location in friendly and 
unfriendly environments incorporating documentation and reporting techniques. 

Language: The course is conducted in English. 

Objectives: At the end of the course students will be able to demonstrate an understanding 
of: 

• The threat of technical espionage 

• Set up and manage a Sweep Team 

• Practical training 

• Physical search 

• Reporting and Documentation 

• Pre-Sweep equipment selection 

Location: German (students should fly to Nuremburg Airport) 

Basic Training Package includes: 

• All teaching, practical and course work in Germany 

• Course notes in hard copy and CD-ROM 

• Individual student assessment 

• Recommendations for future development of skills and equipment 

• Designed for 6 persons 



Rate: 

Hotel accommodation - includes three daily meals, laundry, daily rate for 6 persons 

Payment Terms: 50% on confirmation 

25% on commencement 
25% on completion 
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Example of a TSCM Training Institute Training 



LOCATION: TRAINING INSTITUTE AND END-USER LOCATIONS 





Training office 



TSCM TEST ROOM 





Training room 



Ceiling training office 
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Example of a TSCM Training Institute Training 




Lab 1-TSCM Planning 




Lab 2-TSCM Equipments 
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COURSE NO. 8000: TSCM SEARCH AND TECHNICAL COURSE (TSCM LAB EUROPE) 




MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Introduction: 


The threat (2): 


Practical training (1): 


Practical training (2): 


Practical training (3): 




• Greeting 


• Telecommunication 


Cable measurement: 


Cable measurement: 


The physical search: 


V 


• Presentation of the 


monitoring in PSTN 


• Overview: Methods of 


• Detection of unknown 


• Using NLJDs 


m 

LU 


company and syllabus 


• In house wiretaps 


cable measurement 


wires 


• IR-Thermalvision 


£ 




• Monitoring of wireless 


• Basics and limits of 


• Using a LAN-Tester 


• Demonstrations and 


£ 


The threat (1): 

• Latest technologies 


transmissions 


Time-Domain- 
Reflectometer (TDR) 


• Oscilloscope 

• Multimeters 


practical exercises 


CO 

o 


• Latest methods of 


Counter-measures: 


• NF-andVLF- 


• Other equipment for 


The threat (3): 


Q_ 


wired and wireless 


• The prevention of 


Detection 


cable measurement 


• Telecommunication 


U 

H 


transmissions 


bugging 


• Demonstrations 


• Demonstrations 


and room monitoring 




• Camouflage of bugs 


• Bug-proof rooms 


• Practical exercises by 


• Practical exercises by 


by software attacks 




• Demonstrations of 
sophisticated bugs 


• Methods of TSCM 

• Overview equipment 

• Demonstrations 


the students 


the students 
• Repetition of cable 
measurement 


against ISDN PBXs 
• Demonstrations 
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COURSE NO. 8000 : TSCM SEARCH AND TECHNICAL COURSE (TSCM LAB EUROPE) 




MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Practical training (4): 


Practical training (5): 


Practical exercise (1): 


Practical exercise (2): 


Practical exercise (3): 




The physical search: 


RF-Detection: 


• Complete sweep of 


• Complete sweep of a 


• Complete sweep of a 




• The visual inspection 


• IR-Detection 


the bugged training- 


bugged conference- 


bugged hotel room by 


LU 

LU 


of rooms and 


• Field strength- /Near- 


room by the 


room by the 


the participants (using 


£ 


technically devices 


field-measurement 


participants (using full 


participants (using 


minimum equipment) 


D 


• Endoscopes and 


• Sonic-Labelling and 


equipment) 


reduced equipment) 


• Support by 


CM 


Video-Endoscopes 


Silent Sound 


• Support by 


• Support by 


experienced 


CO 

o 


• X-ray inspection by 


Correlation 


experienced 


experienced 


instructors 


o. 

o 

u 


different systems 
• Metal-Detection 


• Difference-Spectrum- 
Analysis 


instructors 


instructors 


Summary: 


1 


• Demonstrations and 


• Demonstrations and 


Discussion: 


Discussion: 


• Questions/results 




practical exercises 


practical exercises 


• Questions 


• Questions 


• Final discussion about 




• Other equipment 


• Preparing for sweep 


• Evaluation of the 
search results 


• Evaluation of the 
search results 


the course 
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COURSE NO. 8001: TSCM ADVANCED CABLE COURSE (AT COBURG/GERMANY) 




MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Introduction: 


The threat (2): 


Practical training (1): 


Practical training (2): 


Practical exercise (1): 




• Greeting 


• Overview 


RF detection for cable 


The physical search for 


• Physical check of 




• Presentation of the 


telecommunication 


surveys: 


cable surveys: 


bugged and tapped 


LU 

■ ■ i 


company and syllabus 


monitoring today 


• Field strength-/and 


• Using NLJDs 


telecommunication 


UJ 

£ 




• Hard- and Software 


Near field- 


• Endoscopes and 


facilities, telephone 




The threat (1): 


attacks 


measurement 


Video-Endoscopes 


sets, adapters, plugs, 


CO 


• State-of-the-art 




• Sonic-Labelling and 


• X-ray inspection by 


and other accessories 


CO 

(J 


technologies of wired 


Countermeasures: 


Silent Sound 


different systems 


by the students 


o. 


transmissions 


• The prevention of 


Correlation 


• Other equipment 


• Support by an 


O 

1- 


• Camouflage of bugs 

• Demonstrations of 


wire tapping 
• Bug-proof rooms 


• Difference-Spectrum- 
Analysis 


• Demonstrations 

• Practical exercises by 


experienced instructor 




sophisticated bugs 


• Overview cable 
measurement 

• Demonstrations 


• Demonstrations 

• Practical exercises by 
the students 


the students 


Discussion: 

• Questions/results 
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COURSE NO. 8001: TSCM ADVANCED CABLE COURSE (AT COBURG/GERMANY) 




MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Practical training (3): 


Practical training (4): 


Practical training (5): 


Practical exercise (2): 


Practical exercise (3): 




Cable measurement: 


Cable measurement: 


Cable measurement: 


• Cable sweep of 


• Cable sweep of 


LU 


• The inductive 


• Time-Domain- 


• Using a LAN-Tester in 


tapped in-house 


unknown tapped 


m 


Detection of unknown 


Fief lecto meter (TDR) 


structured networks 


wiring by the students 


wiring between 


r\ 


wires 


as the main method: 


(e.g. CAT5) 


• Support by an 


buildings by the 


LJ 


• NF-andVLF- 


Physical basics 


• Demonstrations 


experienced instructor 


students 


CM 

CO 


Detection 


Advantages and 


• Other equipment for 




• Support by an 


o 


• Multi meters 


disadvantages 


cable measurement 


Discussion: 


experienced instructor 


o. 

o 


• Oscilloscopes 


Limits of this 


• Demonstrations 


• Questions/results 




1- 


• Demonstrations 


technology 


• Practical exercises by 


• Preparing for the 


Summary: 




• Practical exercises by 
the students 


• Demonstrations 

• Practical exercises by 
the students 


the students 
• Preparing for the 
exercises next day 


exercises next day 


• Questions/results 

• Final discussion about 
the course 
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COURSE NO. 8002: TSCM SENIOR MANAGEMENT COURSE (TSCM LAB EUROPE) 




MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Introduction: 


Management (1): 


Management (2): 


Management (3): 


Practical exercise: 




• Greeting 


TSCM for Supervisors: 


TSCM for Supervisors: 


TSCM for Supervisors: 


• Supervision of a 




• Presentation of the 


• Typical tasks of a 


• Why and how to carry 


• Preparing a sweep 


sweep by the 




company and syllabus 


sweep team 


out location checks 


• How to carry out 


students (sweep 






• How to set up a 


• Known, unknown, 


sweeps abroad 


carried out by the 




Countermeasures: 


sweep team 


own and strange 


• Improvised sweeps 


organizer's sweep 


CO 


• The prevention of 


• The personnel 


buildings 


• The supervision of a 


team) 


O 


bugging 


requirements 


• Organizational aids: 


sweep 


• Support by 


Q_ 

o 


• Bug-proof rooms 


• The technical 


Checklists 


• Reporting and 


experienced 


H 


• Methods of TSCM 


requirements 


Software 


documentation 


instructors 




• Overview of 


• Managing a sweep 


• Domestic and foreign 


Photos 






equipment 


team 


logistics 


Written reports 


Summary: 




• Demonstrations 






Databases 


• Questions/results 






Discussion: 


Discussion: 




• Final discussion about 






• Questions 


• Questions 


Discussion: 


the course 










• Questions 





CONFIDENTIAL 



1 



TSCM Product Training Course 



elaman 



GEMMA* SECU41ITY SOLUTION I 



TIDNB J 



Model 8004 





COURSE NO. 8004: TSCM PRODUCT TRAINING COURSE (TSCM LAB EUROPE) 




MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Introduction: 


Product training (1): 


Product training (2): 


Product training (3): 


Product training (4): 




• Greeting 


Detection of active 


Detection of active 


The physical search: 


The physical search: 




• Presentation of the 


wireless transmissions: 


wireless transmissions: 


• Using NLJDs 


• The visual inspection 




company and syllabus 


• IR-Detection 

• Field strength- 


• Sonic-Labelling 

• Silent Sound 


• (Dis-)advantages of 
different types 


of rooms and 
technical devices 




Repetition: 


measurement 


Correlation 


• Metal-Detection by 


• Endoscopes and 


s> 


• Latest methods of 


• Near field- 


• Spectrum-Analysis 


different systems 


Video-Endoscopes 


LU 

■ ■I 


wired and wireless 


measurement 


• Difference-Spectrum- 


• IR-Therrmal vision for 


• X-ray inspection by 


UJ 

£ 


transmissions 


• Frequency-Counters 


Analysis 


TSCM (active and 


different systems 


1— 


• Camouflage of bugs 


and other Receivers 


• Practical exercises by 


passive) 


• Other equipment 


CO 


• Methods of TSCM 


• Practical exercises by 


the students 


• Practical exercises by 


• Practical exercises by 


CO 

o 

Q. 

o 

1- 


• Overview equipment 

• Demonstrations 


the students 


• Repetition of RF- 
measurement 


the students 


the students 
• Repetition of the 
physical search 
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COURSE NO. 8004: TSCM PRODUCT TRAINING COURSE (TSCM LAB EUROPE) 




MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Product training (5): 


Product training (6): 


Product training (7): 


Practical exercise (1): 


Practical exercise (2): 




Cable measurement: 


Cable measurement: 


Cable measurement: 


• Sweep of the bugged 


• Sweep of a bugged 




• The inductive 


• Time-Domain- 


• Using a LAN-Tester in 


training-room by the 


hotel room by the 




Detection of unknown 


Reflectometer (TDR) 


structured networks 


students (using full 


students 




wires 


as the main method: 


(e.g. CAT5) 


equipment) 


• Support by an 




• NF-andVLF- 


Physical basics 


• Demonstrations 


• Support by an 


experienced instructor 


LU 

LU 


Detection 


Advantages and 


• Other equipment for 


experienced instructor 




£ 


• Multimeters 


disadvantages 


cable measurement 




Summary: 


D 


• Oscilloscopes 


Limitations of this 


• Practical exercises by 


Discussion: 


• Questions 


CM 


• Practical exercises by 


technology 


the students 


• Questions 


• Evaluation of the 


CO 

o 

o. 

O 

H 


the students 


• Practical exercises by 


• Preparing for the 


• Evaluation of the 


search results 




the students 


sweeps next days 


search results 


• Final discussion about 
the course 
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COURSE NO. 8005: PBX MANIPULATION COURSE (TSCM LAB EUROPE) 




MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Introduction: 


Practical training (1): 


The threat (2): 


Practical training (3): 


The threat (3): 




• Greeting 


Software attacks 


• In-house Wiretaps 


Cable measurement: 


• Telecommunication 




• Presentation of the 


against ISDN PBXs 


• The bugging of 


• Detection of 


monitoring in PSTN 




company and 


demonstrated on 


extensions and 


unknown wires 


• Monitoring of 




syllabus 


different types: 


telecommunication 


• NF-andVLF- 


wireless 






• War-dialling and 


equipment 


Detection 


transmissions 




The threat (1): 


Live-Hacking 


• Demonstrations 


• Basics and limits of 


• Demonstrations 


CO 

t \ 


Software attacks 


• Manipulation of PBX 




Time-Domain- 




w 

CL 


against ISDN PBXs: 


features for 


Practical training (2): 


Reflectometer (TDR) 


Countermeasures 


o 


• Telecommunication 


telecommunication 


Cable measurement: 


• Using a LAN-Tester 


• Software Audits and 




and room 


and room 


• Overview: Methods 


• Other equipment for 


the protection of 




monitoring by 


monitoring 


of cable 


cable measurement 


PBXs and wiring 




software 


• Interception of VoIP 


measurement 


• Demonstrations 






• Hacking of PBX 


• WAN-LAN-access 


• Demonstrations 


• Practical exercises 


Summary: 




remote-access-ports 


• Demonstrations 


• Practical exercises 


by the Students 


• Questions 




• Typical mistakes in 


• Practical exercises 


by the students 




• Final discussion 




configuration 


by the students 






about the course 
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COURSE NO. 8006: PBX ADVANCED MANIPULATION COURSE (TSCM LAB EUROPE) 




MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Introduction: 


Practical training (1): 


Practical training (2): 


Practical training (3): 


Practical training (4): 




• Greeting 


PBX manipulations of 


PBX manipulations of 


PBX manipulations of 


PBX manipulations of 




• Presentation: 

Company and syllabus 


SIEMENS Hi path 4000: 
Demonstrations and 
practical exercises: 


NORTEL Meridian 1 : 
Demonstrations and 
practical exercises: 


ALCATEL Omni PCX 
4400: Demonstrations 
and practical exercises: 


ERICSSON MD110: 
Demonstrations and 
practical exercises: 




The threat: 


• Basics 


• Basics 


• Basics 


• Basics 


CO 

o 


Software attacks against 


• War-dialling and Live- 


• The difficulty of 


• War-dialling and Live- 


• The difficulty of 


ISDN and VoIP PBXs: 


Hacking 


NORTEL-Hacking 


Hacking 


ERICSSON-Hacking 


Q- 


• Monitoring by 


• Manipulation of PBX 


• Manipulation of PBX 


• Manipulation of PBX 


• Manipulation of PBX 


o 

H 


software 

• Hacking of PBX 
remote-access-ports 


features for 
Monitoring 

• WAN-LAN-access 


features for 
Monitoring 

• WAN-LAN-access 


features for 
Monitoring 

• WAN-LAN-access 


features for 
Monitoring 

• WAN-LAN-access 




• Typical mistakes in 
configuration 


• Countermeasures and 
Software Audits 


• Countermeasures and 
Software Audits 


• Countermeasures and 
Software Audits 


• Countermeasures and 
Software Audits 

• Questions 

• Final discussion about 
the course 
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COURSE NO. 8007: PBX SENIOR ENGINEER COURSE (TSCM LAB EUROPE) 




MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Introduction: 


Practical training (1): 


Practical training (2): 


Practical training (3): 


Practical training (4): 




• Greeting 


PBX manipulations of 


PBX manipulations of 


PBX manipulations of 


PBX manipulations of 




• Presentation: 


SIEMENS Hi path 4000: 


NORTEL Meridian 1 : 


ALCATEL Omni PCX 


ERICSSON MD110: 


LU 


Company and syllabus 


Demonstrations and 


Demonstrations and 


4400: Demonstrations 


Demonstrations and 


LU 

£ 


practical exercises: 


practical exercises: 


and practical exercises: 


practical exercises: 


V) 


The threat (1): 


• Basics 


• Basics 


• Basics 


• Basics 




Software attacks against 


• War-dialling and Live- 


• The difficulty of 


• War-dialling and Live- 


• The difficulty of 


to 

O 

o. 


ISDN and VoIP PBXs: 


Hacking 


NORTEL-Hacking 


Hacking 


ERICSSON-Hacking 


• Monitoring by 


• Manipulation of PBX 


• Manipulation of PBX 


• Manipulation of PBX 


• Manipulation of PBX 


O 
■ 


software 


features for 


features for 


features for 


features for 


r- 


• Hacking of PBX 


Monitoring 


Monitoring 


Monitoring 


Monitoring 




remote-access-ports 


• WAN-LAN-access 


• WAN-LAN-access 


• WAN-LAN-access 


• WAN-LAN-access 




• Typical mistakes in 
configuration 


• Countermeasures and 
Software Audits 


• Countermeasures and 
Software Audits 


• Countermeasures and 
Software Audits 


• Countermeasures and 
Software Audits 
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COURSE NO. 8007: PBX SENIOR ENGINEER COURSE (TSCM LAB EUROPE) 




MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Practical training (5): 


Practical training (6): 


The threat (2): 


Practical training (8): 


Practical training (9): 




Additional practical 


Additional practical 


• In-house Wiretaps 


Cable measurement: 


Cable measurement: 


s> 


exercises by the 


exercises by the 


• The bugging of 


• Basics and limits of 


• Detection of unknown 


LU 

■ ■ i 


students: 


students: 


extensions and 


Time-Domain- 


wires 


LU 

£ 


• War-dialling and Live- 


• Manipulation of PBX 


telecommunication 


Reflectometer (TDR) 


• Using a LAN-Tester 


o 


Hacking 


features for 


equipment 


• NF-andVLF- 


• Other equipment for 


CM 


• Interception of VoIP 


Monitoring on 


• Demonstrations 


Detection 


cable measurement 


CO 

O 

o. 

O 
■ 


• The protection of 


SIEMENS, ERICS- 




• Oscilloscope 


• Demonstrations and 


PBXs 


SON, ALCATEL and 
NORTEL platforms 


Practical training (7): 

Cable measurement: 


• Multimeters 

• Demonstrations 


practical exercises 


r- 


Discussion: 

• Questions 

• Repetition 


Discussion: 

• Questions 

• Repetition 


• Overview: Methods of 
cable measurement 


• Practical exercises by 
the students 


Summary: 

• Questions 

• Final discussion about 
the course 
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COURSE NO. 8008: ANTI-HACKING COURSE (TSCM LAB EUROPE) 




MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Introduction: 


The threat (2): 


Practical training (1): 


Practical training (2): 


Practical training (3): 




• Greeting 


Hacking for 


LAN and Internet-Live- 


WLAN-Hacking: 


IT-Forensic: 




• Presentation: 


Administrators 


Hacking: 


• Basics of WLAN 


• LAN-Analysis 




Company and syllabus 


• Man-in-the-Middle 


• LAN-Sniffing 


technology 


• Basics of File 






attacks (encryption) 


• Firewall "Piercing" 


• WLAN Implementing 


Systems 




The threat (1): 


• Firewall Hacking 


• DNS Spoofing 


• WLAN Hacking tools 


• Preparing Images, e.g. 


(/> 


Hacking for 


• Advanced scanning 


• DoS attack 


• WLAN Sniffing 


from HDD, RAM 


o 


Administrators 


techniques 


• Boot attack demo 


• Penetration testing 


• Securing of fleeting 


Q. 

O 


• Hacking tools 


• Scanning tools 


• Penetration testing 


• DoS against WLAN 


evidence 


1- 


• Virus construction 


• Boot attacks 


• Security tools 


• WLAN Security 


• Recovery of deleted 




sets and Trojans 


• DoS and DDoS 


• Demonstrations 


• Demonstrations 


evidence 




• Port-scanning 


• Password-Cracking 


• Practical exercises by 


• Practical exercises by 


• Demonstrations 




• Buffer Overflows 


• Attacks against Web- 


the students 


the students 






• URL attacks 


Applications 




• Common War Driving 


Summary: 




• Path climbing 


• Social engineering 




(live test) 


• Questions/results 




• Browser attacks 


• Demonstrations and 






• Final discussion about 




• Demonstrations 


practical exercises 






the course 
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COURSE NO. 8008: ANTI-HACKING COURSE (TSCM LAB EUROPE) 






MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Practical training (5): 


Practical training (6): 


The threat (2): 


Practical training (8): 


Practical training (9): 




Additional practical 


Additional practical 


• In-house Wiretaps 


Cable measurement: 


Cable measurement: 




exercises by the 


exercises by the 


• The bugging of 


• Basics and limits of 


• Detection of unknown 


LU 


students: 


students: 


extensions and 


Time-Domain- 


wires 


£ 


• War-dialling and Live- 


• Manipulation of PBX 


telecommunication 


Reflectometer (TDR) 


• Using a LAN-Tester 


Q 


Hacking 


features for 


equipment 


• NF-andVLF- 


• Other equipment for 


CM 


• Interception of VoIP 


Monitoring on 


• Demonstrations 


Detection 


cable measurement 


to 

o 

Q_ 

0 

1 


• The protection of 


SIEMENS, ERICS- 




• Oscilloscope 


• Demonstrations and 


PBXs 


SON, ALCATEL and 
NORTEL platforms 


Practical training (7): 

Cable measurement: 


• Multimeters 

• Demonstrations 


practical exercises 


H 


Discussion: 

• Questions 

• Repetition 


Discussion: 

• Questions 

• Repetition 


• Overview: Methods of 
cable measurement 


• Practical exercises by 
the students 


Summary: 

• Questions 

• Final discussion about 
the course 
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COURSE NO. 8011: TSCM SWEEP TEAM REVIEW (END USER COUNTRY) 




SUNDAY 


MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 




Introduction: 


Practical exercise (1): 


Practical exercise (2): 


Practical exercise (3): 


Practical exercise (4): 




• Visiting the 


• Sweep of a bugged 


• Sweep of a bugged 


• Sweep of a bugged 


• Sweep of a bugged 




customer's facilities 


hotel room by the 


conference room by 


office by the students 


living room by the 




• Checking the existing 


students 


the students 


• Support by an 


students 


CO 


TSCM equipment 


• Support by an 


• Support by an 


experienced instructor 


• Support by an 


o 




experienced instructor 


experienced instructor 




experienced instructor 


Q- 

n 


Repetition 






Discussion: 




1- 


Countermeasures: 


Discussion: 


Discussion: 


• Questions 


Summary: 




• The prevention 


• Questions 


• Questions 


• Evaluation of the 


• Questions 




• Methods of TSCM 


• Evaluation of the 


• Evaluation of the 


search results 


• Evaluation of the 




• Overview equipment 


search results 


search results 


• Preparing for the 


search results 




• Preparing for the 


• Preparing for the 


• Preparing for the 


sweep next day 


• Final discussion about 




sweep next day 


sweep next day 


sweep next day 




the course 
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COURSE NO. 8011: TSCM SWEEP TEAM REVIEW (END USER COUNTRY) 






MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Practical training (5): 


Practical training (6): 


The threat (2): 


Practical training (8): 


Practical training (9): 




Additional practical 


Additional practical 


• In-house Wiretaps 


Cable measurement: 


Cable measurement: 


SV 


exercises by the 


exercises by the 


• The bugging of 


• Basics and limits of 


• Detection of unknown 


LU 
■ ■ ■ 


students: 


students: 


extensions and 


Time-Domain- 


wires 


LU 

£ 


• War-dialling and Live- 


• Manipulation of PBX 


telecommunication 


Reflectometer (TDR) 


• Using a LAN-Tester 


o 


Hacking 


features for 


equipment 


• NF-andVLF- 


• Other equipment for 


CM 


• Interception of VoIP 


Monitoring on 


• Demonstrations 


Detection 


cable measurement 


CO 

o 

Q_ 

o 


• The protection of 


SIEMENS, ERICS- 




• Oscilloscope 


• Demonstrations and 


PBXs 


SON, ALCATEL and 
NORTEL platforms 


Practical training (7): 

Cable measurement: 


• Multimeters 

• Demonstrations 


practical exercises 


1— 


Discussion: 

• Questions 

• Repetition 


Discussion: 

• Questions 

• Repetition 


• Overview: Methods of 
cable measurement 


• Practical exercises by 
the students 


Summary: 

• Questions 

• Final discussion about 
the course 
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COURSE NO. 8012: TSCM EQUIPMENT AUDIT (END USER COUNTRY) 




SUNDAY 


MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


TOPICS 


Introduction: 

• Visiting the 
customer's facilities 

• Checking the existing 
TSCM equipment 

Repetition: The threat 

(1): 

• Latest technologies of 
technical espionage 

• Latest methods of 
wired and wireless 
transmissions 

• Camouflage of bugs 


Repetition: The threat 
(2): 

• Telecommunication 
monitoring in PSTN 

• In-house Wiretaps 

• Monitoring of wireless 
transmissions 

Repetition: 

Countermeasures: 

• The prevention of 
bugging 

• Bug-proof rooms 

• Methods of TSCM 

• Overview equipment 

Discussion: 

• Questions 


Practical training (1): 

Cable measurement with 

the customer's 

equipment: 

• Detection of unknown 
wires 

• NF-andVLF- 
Detection 

• Basics and limits of 
Time-Domain- 
Reflectometer (TDR) 

• Using a LAN-Tester 

• Other equipment for 
cable measurement 

• Demonstrations 

• Practical exercises by 
the Students 


Practical training (2): 

The physical search with 

the customer's 

equipment: 

• Visual inspection of 
rooms and technical 
equipment 

• Using optical 
Endoscopes and other 
optical aids 

• X-ray inspection 

• Using the NLJD 

• Metal-Detection 

• Other equipment for 
physical search 

• Demonstrations 

• Practical exercises by 
the Students 


Practical training (3): 

RF-Detection with the 

customer's equipment: 

• IR-Detection 

• Field strength- /Near- 
field-measurement 

• Sonic-Labelling and 
Silent Sound 
Correlation 

• Spectrum-Analysis 

• Other equipment for 
RF-measurement 

• Practical exercises by 
the Students 

Summary: 

• Final discussion about 
the course 
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COURSE NO. 8012: TSCM EQUIPMENT AUDIT (END USER COUNTRY) 






MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Practical training (5): 


Practical training (6): 


The threat (2): 


Practical training (8): 


Practical training (9): 




Additional practical 


Additional practical 


• In-house Wiretaps 


Cable measurement: 


Cable measurement: 




exercises by the 


exercises by the 


• The bugging of 


• Basics and limits of 


• Detection of unknown 




students: 


students: 


extensions and 


Time-Domain- 


wires 


LU 

LU 


• War-dialling and Live- 


• Manipulation of PBX 


telecommunication 


Reflectometer (TDR) 


• Using a LAN-Tester 


£ 


Hacking 


features for 


equipment 


• NF-andVLF- 


• Other equipment for 


D 


• Interception of VoIP 


Monitoring on 


• Demonstrations 


Detection 


cable measurement 


CM 


• The protection of 


SIEMENS, ERICS- 




• Oscilloscope 


• Demonstrations and 


CO 

o 

Q- 


PBXs 


SON, ALCATEL and 
NORTEL platforms 


Practical training (7): 

Cable measurement: 


• Multimeters 

• Demonstrations 


practical exercises 


o 

1- 


Discussion: 

• Questions 

• Repetition 


Discussion: 

• Questions 

• Repetition 


• Overview: Methods of 
cable measurement 


• Practical exercises by 
the students 


Summary: 

• Questions 

• Final discussion about 
the course 
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COURSE NO. 8013: TSCM PRODUCT TRAINING COURSE (END USER COUNTRY) 




SUNDAY 


MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 




Introduction: 


Product training (2): 


Product training (3): 


Product training (4): 


Product training (5): 


& 


• Visiting the 


Cable measurement with 


Cable measurement with 


Detection of active 


Detection of active 


O 


customer's facilities 


the customer's 


the customer's 


wireless transmissions: 


wireless transmissions: 


H 

o 


• Checking the existing 


equipment: 


equipment: 


• IR-Detection 


• Sonic-Labelling 


O' 


equipment for RF- and 


• NF-andVLF- 


• Oscilloscope 


• Field strength- 


• Silent Sound 


H- 

c n 


cable measurement 


Detection 


• Multimeters 


measurement 


Correlation 






• Detection of unknown 


• Using a LAN-Tester 


• Near field- 


• Spectrum-Analysis 


LU 


Product training (1): 


wires 


• Other equipment for 


measurement 


• Difference-Spectrum- 


LU 

> 


• Overview: Cable 


• Basics and limits of 


cable measurement 


• Frequency-Counters 


Analysis 


H 


measurement 


Time-Dormain- 


• Practical exercises 


and other Receivers 


• Practical exercises 


CO 


• Practical exercises 


Reflectometer (TDR) 


• Repetition of cable 


• Practical exercises 


• Repetition of RF- 






• Practical exercises 


measurement 




measurement 
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COURSE NO. 8013: TSCM PRODUCT TRAINING COURSE (END USER COUNTRY) 





SUNDAY 


MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 




Introduction: 


Product training (7): 


Practical exercise (1): 


Practical exercise (2): 


Practical exercise (3): 


, k 


• Visiting the customers 


The physical search: 


• Sweep of a bugged 


• Sweep of a bugged 


• Sweep of a bugged 


CM 

rv 


facilities 


• Metal-Detection 


office by the students 


conference room by 


hotel room by the 


o 


• Checking the existing 


• IR-Thermal vision 


(using full equipment) 


the students (using 


students 


1— 

o 


equipment for 


• Visual inspection 


• Support by an 


reduced equipment) 


• Support by an 


O' 

H- 

c n 


physical search 


• Endoscopes and 
Video-Endoscopes 


experienced instructor 


• Support by an 

experienced instructor 


experienced instructor 




Product training (6): 


• X-ray inspection by 


Discussion: 




Summary: 


LU 


The physical search 


different systems 


• Questions 


Discussion: 


• Questions 


LLJ 

> 


measurement with the 


• Other equipment 


• Evaluation of the 


• Questions 


• Evaluation of the 


Q 


customer's equipment: 


• Practical exercises 


search results 


• Evaluation of the 


search results 




• Using NLJDs 


• Repetition of physical 


• Preparing for the 


search results 


• Final discussion about 


CM 


• (Dis-)advantages of 
different types 

• Practical exercises 


search 

• Preparing for sweep 
the next day 


sweep next day 


• Preparing for the 
sweep next day 


the course 
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COURSE NO. 8014: PBX-ISP PENETRATION ASSESSMENT (END USER COUNTRY) 




SUNDAY 


MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 




Introduction: 


The threat (2): 


The threat (3): 


Practical training (1): 


Practical training (2): 




• Visiting the 


Hacking for Administrators: 


Hacking for 


LAN and Internet-Live- 


WLAN-Hacking: 




customer's facilities 


• Hacking tools 


Administrators: 


Hacking: 


• Basics of WLAN 




• Checking the existing 


• Virus construction sets 


• Man-in-the-Middle 


• LAN-Sniffing 


• WLAN 




PBX equipment 


and Trojans 
• Port-scanning 


attacks (encryption) 
• Firewall Hacking 


• Firewall "Piercing" 

• DNS Spoofing 


Implementing 
• WLAN Hacking tools 




The threat (1): 


• Buffer Overflows 


• Scanning tools 


• DoS attack 


• WLAN Sniffing 




ISDN PBXs: 


• URL attacks 


• Boot attacks 


• Boot attack demo 


• Penetration testing 




• Telecommunication 


• Path climbing 


• DoS and DDoS 


• Penetration testing 


• DoS against WLAN 


CO 

o 


and room monitoring 


• Browser attacks 


• Password-Cracking 


• Security tools 


• WLAN Security 


Q_ 


by software 


• Demonstrations 


• Attacks against 


• Demonstrations 


• Demonstrations 


O 

1 — 


• Hacking of PBX 


• Practical exercises by the 


Web-Applications 


• Practical exercises 


• Practical exercises 




remote-access-ports 

• Typical mistakes in 
configuration 

• Manipulation of PBX 
features 

• Interception of VoIP 

• WAN-LAN-access 

• The protection of 
PBXs 


students 


• Social engineering 

• Demonstrations 

• Practical exercises 
by the students 


by the students 


by the students 

• Common War 
Driving (live test) 

Summary: 

• Questions 

• Final discussion 
about the course 
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COURSE NO. 8016: TSCM SWEEPING OF CARS FOR PROFESSIONALS (TSCM LAB EUROPE) 




MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 


TOPICS 


Introduction: 

• Greeting 

• Presentation of the 
company and 
syllabus 

Countermeasures: 

• Basic knowledge of 
automotive 
electronics 

• Communication 
technology in cars 

• Hiding places and 
hollows in and under 
cars 

• Considering bullet- 
proof cars 

• Overview equipment 
for sweeping of cars 

• Preparing for the car 
sweep next day 


Practical exercise (1): 

Sweep of a bugged 
luxury car (e.g. Mercedes 
S-Class, BMW 7-series 
or AUDI A8 by the 
students: 

• Briefing and technical 
instructions by an 
experienced 
mechanic 

• Disassembling the 
interior 

• Physical check of 
interior and cabin 

• Support by an 
experienced 
instructor and 
mechanic 

Discussion: 

• Questions 

• Results of the day 


Practical exercise (2): 

Sweep of a bugged luxury 

car by the students (part 

2): 

• Near field 
measurement 

• Difference-Spectrum- 
Analysis 

• X-ray inspection by 
different systems 

• Disassembling the 
dashboard 

• Measurement of 
Electronic Components 

• Support by an 
experienced instructor 
and mechanic 

Discussion: 

• Questions 

• Results of the day 


Practical exercise (3): 

Sweep of a bugged car by 

the students (part 3): 

• Physical search in 
engine compartment 
and boot 

• Reassembling of parts 

• Visual inspection of the 
underside 

• Using mirrors, 
Endoscopes and Video- 
Endoscopes 

• Using NLJDs 

• Support by an 
experienced instructor 
and mechanic 

Discussion: 

• Questions 

• Results of the day 


Practical exercise (4): 

Sweep of a bugged car by 

the students (part 4): 

• Final checks and 
measurements 

• Final reassembling of 
parts 

• Test run 

• Documentation and 
Reporting 

• Support by an 
experienced instructor 
and mechanic 

Summary: 

• Questions 

• Evaluation of the 
search results 

• Final discussion about 
the course 
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COURSE NO. 8017: COMPUTER FORENSICS 






MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Introduction: 


Forensic basics : 


Forensic analysis 1: 


Forensics Analysis II: 


Mobile Forensics: 




• Greeting 


• Processing Crime and 


• File forensics 


• Tool usage 


• Hardware tools 




• Presentation of the 


Incident Scenes 


• E-Mail Investigations 


• Encase Forensic 


• Software tools 




company and syllabus 


• Digital Evidence 
Controls 


• Investigating data 
streams 


Edition, 

• X-Ways Forensic 


• Recovering deleted 
data from SIM card 




Introduction: 


• Microsoft Windows 


• File storage dates and 


• Forensic Toolkit (FTK), 


• Recovering deleted 




• Computer Forensics 


Systems 


times 


• Linux tools 


data from a cell phone 




and Investigations 


• Unix Systems 


• File deletion/recovery 


• Linux forensic suites 


• PDA Computer 


</) 


• Forensic Office and 


• Boot Processes and 


• Recovering Internet 


• Sysinternals tools 


Forensics 


o 

a 


Laboratory 
• Forensic process 


File Systems 
• Preparing sterile 


Usage Data 
• Recovering: Swap 


• Case Study 




U 

i- 


• Current Computer 


examination media 


Files/Temporary 


Discussion: 


Summary: 




Forensics Tools 


• Data Acquisition 

• Write Blocker 

Discussion: 

• Questions 

• Results of the day 


Files/Cache Files 

Discussion: 

• Questions 

• Results of the day 


• Questions 

• Results of the day 


• Questions 

• Final discussion about 
the course 
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COURSE NO. 8018: TSCM IT COURSE 




MONDAY 


TUESDAY 


WEDNESDAY 


THURSDAY 


FRIDAY 




Introduction 


Information Gathering 


Attacking 


Attacking 


Cryptography 






• Search Engines 


• Passwords 


• Wireless 


• File Systems 




FinFisher Attacks 


• 


• Bypass 


• WLAN 


• Communication 




• FinFisher 1 


• Networks 


• Default 


• Bluetooth 


• SSL 




• FinFisher 2 


• Mapping 


• Brute force 


• Keyboards 






• FinFisher 3 


• Scanning 


• Cracking 




• Policies 






• Enumeration 




• Voice-over-IP 


• Notebooks 


CO 

o 


Trojan Horses 


• Sniffing 


• Software Security 


• Audio Sniffing 


• External Networks 


• Features 


• Redirection 


• Attacks 


• Protocol Attacks 


• Internal Networks 


a 


• Detection 




• Verification 




• Hardware 


o 

h- 


• Prevention 


• 


• Prevention 










• Countermeasure 




• Countermeasure 








• Model 7543 




• Model 7540 








• LAN/WLAN 
Analyzer 




• WiFi Detector 
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Product Description 



Products 



Ref. 


Qtv 


Model 


Description 


1 


1 


7501 


NLJD Non Linear Junction Detector 


1b 




7501-2 


Advanced Non Linear Junction Detector 


2 


1 


7502-1 


TSCM Search Tool Kit 


3 


1 


7502-2 


Advanced /Telecomms Search Tool Kit 


4 


1 


7504 


Portable X-Ray System 


4b 


1 


7504 option 


Advanced Flat Screen X-Ray Imager 


5 


1 


7505 


Thermal - Wall Scanner 


5b 


1 


7505-2 


Thermal Imaging for Surveillance Applications 


6 


1 


7506 


Locator 


7 


1 


7507-01 


Optical System to Detect Cameras, Lens (Room Version) 


8 


1 


7508 


Advanced Scan Detector System 


9 


1 


7509 


TDR Multi Channel Cable Detector 


10 


1 


7510 


Digital Advanced Eland Held Oscilloscope 


11 


1 


7511 


Detection Receiver 


12 


1 


7513 


Wall Depth Measurement System 


13 


1 


7514-2 


video remote probe inspection 


14 


1 


7515 


Marking Kit-Covert Stickers Illuminator 


15 


1 


7516 


Optical Search Toolkit 


16 


1 


7517-01 


Video and Audio RF Detection System 


17 


1 


7517-02 


Advanced Video & Audio RF Detection System 


18 


1 


7518 oscor 


OMNI SPECTRAL CORRELATOR 


19 


1 


7518 option 


Omni Spectral Correlator 


20 


1 


3521 


High Power GSM Jamming System 


21 


1 


3522 


Room Jammer 


22 


1 


3525 


Computer Screening Jammer 


23 


1 


3526 


Anti-Laser-Microphone Noise Jammer 


24 


1 


3527 


Advanced Counter Surveillance Jammer 


25 


1 


7519 


FSH Portable Spectrum Analyzer 


26 


1 


7520 


Bug Detector 


27 


1 


7521 


EB200-High Speed Frequency Scanner 3 GHz with DF 
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Product Description Products 



28 


1 


7522 


Digital Scout Frequency Detector 


29 


1 


7523 


Advanced Cable Tracing System 


30 


1 


7525 


X-ray for Screening VIP Presents 


31 


1 


7527 


Encryption Product - GSM Encryption Phones 


32 


1 


7530 


Ultra Scan50b 


33 


1 


7539 


3D image enhancer 


34 


1 


7540 


Wireless Network detector 


35 


1 


7541 


Telephone Line analyzer Detector 


36 


1 


7542 


Secure document scanner 


37 


1 


7543 


LAN/WLAN Checking System 


38 


1 


7544 


TSCM Search Video Pole Camera 


39 


1 


7545 


Video Wireless Detection 


40 


1 


7546 


Cable Amplifier System 


41 


1 


7547 


Flat Panel X-ray system 


42 


1 


4014 


GSM Detection System 


43 


1 


1013 


Night Vision kit 


44 


1 


2001 


Door Opening kit 
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Recommended Product Description Sweep List 

Special Sweep List 
Government Approved 



For in-country sweep teams, including portable cases and vehicles 

This equipment is installed in portable casing, which can easily be moved from place to place 



1 . 1 . 



1.1.2 



1 . 2 . 



Model 7501 - 4th Generation NLJD Electronic Circuitry Detector 

(PASSIVE) 

The Non Linear Junction Detector (NLJD) is used in the initial physical 
search phase of a sweep. Its unique use allows an operative to quickly 
and effectively scan a location for concealed electronic components. 
The Model 7501 is a versatile third harmonic NLJD which detects, 
analyzes and pin-points the location of suspect electronic devices, 
whether they are switched on or off. 



Model 7501-2 - Advanced NLJD (PASSIVE) 

The unit provides the capability to detect hidden electronic devices, 
regardless of whether the device is radiating, hard wired, or even 
turned on at all! Its unique design means that it is lightweight, 
completely portable and folds away into a small case. 





Model 7502-1 - Search Tools and Test Equipment (SEARCH) 

This tool kit is usually used with a Non-linear Junction Detector (NLJD) 
and provides tools that are uniquely suited for use with an NLJD. The 
tool kit comes in a leather tool bag. 



Model 7502-2 - Advanced/Telecoms Search Tool kit (SEARCH) 




1.3. 



Designed as a TSCM team toolkit that includes all the necessary tools 
needed to carry out a thorough physical and cable search. Containing 
the basic toolset required for telephone sweeps, such as a digital 
multimeter, butt set and structured cabling tools; it compliments more 
advanced cable tools such as the Line Amplifier or CPM700. All the 
electro mechanical tools in this set have been put together to provide a 
wide range of aids for completing a full physical search, such as work 
lights, mirrors, opening tools and even a drill to allow use of 
borescopes or videoscopes. 

Model 7504 - Portable X-Ray System Software Viewing System 

(OPTICAL SEARCH) 

This unit can see though objects to check on electronic circuitry/tape 
recorders/transmitters and microphones/cameras, hidden in secret 
areas. It is also used to compare electrical devices for any changes on 
PCB boards. This mobile x-ray generator comes with a PC and a 
camera to detect any bugs hidden in gifts presented to VIPs. 
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Recommended Product Description 

Model 7504 Option - Advanced Flat Screen X-Ray Imager 

A flat panel x-ray imager offering high resolution images in the most 
confined spaces from different orientations and with even greater 
coverage (25 x 33 cm). Specifically designed for security and law 
enforcement professionals it is flatter, safer, stronger and less 
expensive than many other fragile flat panel units. It is available as a 
complete x-ray system or a single flat panel upgrade. 

1.4. Model 7505 - Optical Wall Scanning System, NATO Approved 

(SEARCH) 

The physical inspection of a target location is the most time consuming 
part of a sweep. All surfaces and objects must be inspected. The 
Model 7505 was developed to perform a quick and thorough search to 
locate concealed eavesdropping devices. A concealed device will emit 
a heat signature easily spotted by a thermal inspection system. 



1.4.2 Model 7505-2 - Thermal Imaging for Surveillance Applications 

(SEARCH) 

The Unit is a flexible, easy to use, handheld thermal imager, which is 
suitable for all law enforcement operations, including surveillance, 
TSCM, police, firearms teams and others. It has a large clear display, a 
150+ m image range, image storage to SD card, and temperature 
measurement that is ideal for hydroponics. It can detect people in total 
darkness and allows covert distance surveillance offering high 
resolution images of 160x120 pixels and an auto hotspot tracker that is 
useful for highlighting people. 

1.5. Model 7506 - Locator - Locates & Detects Transmitters 

(RF LOCATION) 

This portable hand-held unit is used to pinpoint the exact location of a 
detected transmitter and can locate both analog and digital 
transmitters. 

1.6. Model 7507-01 - Video Camera and Lens Detector 

(OPTICAL SEARCH) 

This hand-held system will detect cameras/lenses covertly installed in 
rooms and conference places. (Room version) 



1.7. Model 7508 - Building Sweep System with Dual 

Antenna/Software (ACTIVE RF) 

The Advanced Scan Detector System, Model 7508, is uniquely different 
from all other RF Detection Systems. It is an advanced system which 
uses spectrum analyzer with the latest software technologies to 
provide accurate results. It uses a twin antenna system, placing one 
antenna outside of the target location and one inside. Using the 
software it is able to show all suspicious transmissions which are 
stronger in the target location than outside. This is a strong indicator of 
a transmitting eavesdropping device. 

CONFIDENTIAL 



Sweep List 




J Oil 

i l 



2 





elaman 

«■ V / 



OEKU4H KtUlITT igiUTIDNI 



Recommended Product Description 



Sweep List 



1 . 8 . 



Model 7509 - Multi-Channel Wired Analyzer (CABLES) 

The unit is one of the most valuable TSCM test instruments available. 
This equipment is capable of detecting many wiretap methods that are 
undetectable by conventional telephone analyzers, meters or other 
instrumentation. The unit is designed to reveal all wire irregularities by 
displaying the characteristic signatures and distances to each wire 
irregularity. Without a TDR, the presence and location of all wire 
irregularities cannot be pinpointed, and therefore will not be physically 
inspected. 




1.9. Model 7510 Digital Advanced Handheld Oscilloscope (CABLES) 

The digital oscilloscope is useful for measuring all the basic 
measurements in electronic equipment and for establishing 
modifications that could have been caused by manipulation or 
integration of surveillance equipment. 

1.10. Model 7511 - Detection Receiver (RF ACTIVE/IR) 




One of the first tools to be used during a physical search should be the 
Broadband RF Detector. This versatile unit can indicate the location of 
a transmission source, whether hidden in phone, room or body 
transmitters, remote control signals, computer bugs, fax or telex 
transmitters, video transmitters, pulsed tracking transmitters, spread 
spectrum, and even wide band frequency hopping or 'burst' 
transmitters. This is a multi use tool which covers a wide range of 
tasks from basic physical searches to cable verification. 




1.11. Model 7513 - Through-The-Wall Display System (SEARCH) 

This unit measures the depth of a wall and shows objects, such as 
microphone cables, transmitters or cameras on a in-built display. This 
can be used in conjunction with a Non Linear Junction Detector. 




1.12. Model 7514 2 - Video Probe Remote Visual Inspection (SEARCH) 

A remote visual video boreoscope power tool for improving inspection 
productivity. The base is a portable workstation for inspection data 
management, plus a light source and storage reel for the probe. It has a 
high resolution LCD screen and powerful computing platform for data 
management and worldwide connectivity. Probes come in size from 
3.2 mm up to 8.4 mm in diameter. 




1.13. Model 7515 - Secret Marking Kit Seals and Light Source (SEARCH) 

After carrying out a room search special equipment is used to mark the 
searched area. A check of the room can be made later to see if 
anything has been tampered with, for example, after a sweep all 
electrical sockets are secretly marked so if an intruder tries to connect 
a bug it can be detected. 
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Recommended Product Description 



Sweep List 



1.14. Model 7516 - Optical Search System Set (SEARCH) 

The Optical Search Toolkit is the budget alternative accessory kit to 
enable a thorough and effective physical search. For use in validating 
information provided with other equipment, such as the NLJD, the 
Optical Search Toolkit is ideal for searching hard to reach and 
inaccessible areas. 




1.15. Model 7517-01 - Audio-Video Transmission Decoder Detector 
Analyzer 

(ACTIVE RF) 

The unit analyzes, detects and decodes audio/video RF transmission 
and displays its results on an in-built monitor. It also scans telephone 
and mains cables. This unit can detect infrared. The frequency 
coverage is up to 3000 MHz. A NATO-approved antenna system 
enables covert scanning to take place. 



1.16. Model 7517-02 - Advance AA/ Transmission Decoder Detector 
Analyzer 

(ACTIVE RF) 

This unit can sweep an entire building from one location. This model is 
the next-level model 7517-02 with a frequency range of 10 KHz-6 GHz. 

1.17. Model 7518 Oscor - Omni Spectral Correlator 

A phased locked super heterodyne spectrum analyzer, designed 
specifically for counter surveillance that automatically selects antenna 
inputs. Frequency spans can be programmed with single button control 
for rapid recall and automatic searching. Patented fold out antenna 
panel automatically selects the proper antenna. Enhanced trace 
analysis provides ability to compare target sweep area traces to friendly 
traces, to quickly identify evidence of transmitters in target sweep area. 





Model 7518 option - Microwave Downconverter 

The OSCOR Microwave Downconverter option (MDC-2100) features an 
array of high gain directional antennas. It can function in sweep, analyze 
and correlation modes and includes a tripod. The MDC-2100 can be 
used in a stationary position sitting on the provided tripod or it can be 
moved around to provide a thorough sweep of the area. For proper 
operation, the MDC-2100 should be located at least three feet away 
from the OSCOR. 

1.18. Model 3521 - GSM Hi-Power Jamming System (JAMMING) 

This portable GSM jamming system can jam and protect meetings and 
conferences with its 25-watt output. The system is also available in 
CDMA frequencies upon request. Other optional extras include output 
power up to 1 20-watt to protect complete areas. 
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Recommended Product Description 



Sweep List 



1.19. Model 3525 - Computer Screening Jammer - Defender (JAMMING) 

The Defender will jam the frequencies emitted from a 
monitor/computer/keyboard that can be monitored by hi-tech 
interception equipment, without interfering with the operation of your 
computer. 

1.20. Model 3526 - Laser Jamming System (JAMMING) 

This unit jams laser and audio signals in a room. Sensors are attached to 
windows and can stop any laser system from working. 



1 .21 . Model 3527 - Jamming System 20-2400 MHz (JAMMING) 

This Jammer will protect against wireless RF video and audio bugs. It is 
portable and easy to use and covers a wide band. It has a white noise 
tone generator adding extra security. 



1.22. Model 7519 - FSH Spectrum Analyzer (RF ACTIVE) 

This Hand-held Spectrum Analyzer enables quick and effective RF 
measurement of rooms and signal analysis. It displays all analog and 
digital signals. The FSH is available in 2 models: 100-3 GHZ or 100 - 6 
GHz. The 6 GHz is particularly interesting for detecting 5.8 GHz video 
signals. 



1.23. Model 7520 - Covert Bug Detector 

Powerful, sensitive and adjustable cigarette 



(Detection) 

box size bug detector, 
which detects active transmitters and bugging devices close by. Its 
discrete vibrating alarm allows it to be body-worn. Powerful 
rechargeable batteries guarantee long operating time. 

1.24. EB200 - High Speed Frequency Scanner with DF (RF ACTIVE) 

The EB200 with its digital scan mode enables band frequencies of up to 
3 GHz to be scanned in milliseconds enabling short burst transmitters, 
remote control transmissions, etc. to be immediately detected and 
located. 

1.25. Model 7522 - Digital Scout Frequency Detector (RF ACTIVE) 

This hand-held unit provides an immediate frequency fix of possible 
transmissions in a closed area. With an add-on receiver the audio of the 
captured signal can be heard. 





a 



1.26. Model 7523 - Cable Tracking System (CABLES) 

With cable measurement taking up to 30 percent of a sweep effort, 
tools that provide important information effectively and quickly are 
needed. The Advanced Cable Tracing System is designed to aid in 
locating all cables coming from the target location. Capable of tracing 
cables buried as deep as 2 meters, this system excels in ensuring all 
potentially dangerous cables are found. 
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Recommended Product Description 



Sweep List 



1.27. Model 7525 - X-ray System for VIP Gifts, Presents, etc (SEARCH) 

As a security precaution all received gifts should be x-rayed for any 
possible surveillance equipment -- remember the gift the Russians gave 
to the Americans? 




1 .28. ROHDE & SCHWARZ GSM Encryption (VOICE PROTECTION) 

GSM Encryption is used to secure the communication of the VIP/sweep 
team members. The system is compatible with desktop telephones 
and secures what is sent over the network. This is also available for e- 
mail security. 




1.29. Model 7530 - X-ray Unit (SEARCH) 

As a security precaution this product would be used for checking VIP 
gifts and objects such as bags, telephone phones, etc. to locate any 
bugging equipment. 


MM 


1.30. Model 7539 - 3D Image Enhancer (SEARCH) 

The 3D Image Enhancer is a mobile system that converts 2d x-ray 
images into 3d images. It can be quickly and easily set up and its user 
friendly interface means no extra training is required. It can convert 
conventional films and storage foils. 






1.31. Model 7540 - Wireless Network Detector (Detection) 

A professional Wireless Network Detection and Visualization tool that 
detects and stores all the important information about your wireless 
network environment automatically to an SQL Database, and visualizes 
your WLAN infrastructure on your own imported maps. 


mm. 




1.32. Model 7541 - Telephone Line Analyzer (Detection) 

Second to the physical search, cable and wiring checks are the most 
time consuming and technical. To ensure an effective and thorough 
cable check, there are over 10 checks for each cable, requiring a skilled 
operative and careful documentation. The Telephone Line Analyzer 
provides a complete integrated suite of tools to analyze, inspect, and 
test digital telephone lines (and other wiring) for taps and other 
eavesdropping devices. 






1.33. Model 7542 - Secure Document Scanner (Detection) 

An innovative overall concept for handling important and confidential 
documents that uses a newly developed security-paper, which acts as a 
magnetic storage medium. It uses a special read-write device that 
connects to a PC or laptop. The digital document-certificates are 
administered through a Trust Center. This scanner offers state-of-the-art 
technical solutions for document protection that are beyond comparison, 





especially developed for high security demands. 
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Recommended Product Description 

1.34. Model 7543 - LAN/WLAN Checking System 



Sweep List 



(Detection) 




The LAN checking system has come a long way since just checking 
structured cabling. The threat of an IT related attack has heightened 
bringing with it the need to check IT systems. The LAN/WLAN 
Checking System is capable of performing checks on structured cabling 
and any data present on the line. Its semi automated checks provide 
clear information presented in a printable report. 

1.35. Model 7544 - Video Pole Camera (SEARCH) 

Sometime during a physical inspection it is not be possible to have the 
means or time to inspect all hard to reach areas. The Video Pole Camera 
was developed with the aim of providing an accurate search of the 
target location. With its hi-resolution camera and screen and 6-foot reach 
it is possible to get into areas a search mirror kit cannot. Inspect drop 
ceilings, behind immovable objects, around corners, or other difficult to 
reach areas, even in dark situations with the Video Pole Camera. 

1.36. Model 7545 - Video Wireless Detection (Detection) 

A fast scanning receiver that detects wireless video cameras. A 2.5" 
TFT color LCD displays what the hidden camera is looking at. A smaller 
LCM displays the frequency and signal it is locked on to. It can scan all 
available video frequencies in 15 seconds and detect signals as far away 
as 500 feet. 

1.37. Model 7546 - Cable Amplifier System (Detection) 

The Cable Amplifier System is a high gain audio amplifier used to detect 
and identify certain types of surveillance devices attached to building 
wiring, such as telephone wiring, LAN and server systems, AC power, 
alarm wires, etc. It provides flexible features and has proven to be very 
useful in many situations. This amplifier is quite useful for checking 
telephone lines and other wiring for hostile microphones, testing for 
hook switch audio leakage, and detection of eavesdropping devices that 
are sensitive to bias voltages or currents. 

1.38. Model 7547 - Flat Panel X-ray System 

The unit is a state-of-the art digital mobile flat panel X-ray system 
manufactured in Western Europe. The flat image converter enables 
many different applications in the fields of security and non-destructive- 
testing. For EOD use the Notebook provides a save operation by 100 m 
cable or remote control. The high resolution of 127 m allows the 
identification of even the smallest details on X-ray images with more 
than 16,000 grey levels. 

1.39. Model 4014 - GSM Detection System (Detection) 

This system was developed as a counter-measure to detect active GSM 
monitoring systems that create bogus sites. It is a GSM receiver, which 
constantly scans the GSM control channels of all networks (dual band) 
looking for changes in the overhead parameters transmitted by the 
genuine network. The GSM Detection System is able to recognize 
bogus cell sites that are attempting to mimic a legitimate site for its own 
purposes. Used for protection in embassies or high level meetings. 
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Recommended Product Description 



Sweep List 



1.40. Model 1013 - Night Vision Viewer (IR & FIBER OPTIC SEARCH) 

Usually used in surveillance operations. Night Vision Viewer has a dual 
role in a TSCM team in the search for fiber optic microphones, laser and 
IR rays that are almost impossible to detect with standard sweep 
equipment. 




1.41. Model 2001 - Lock-Picking for Entry into Closed Areas (SEARCH) 

When carrying out a sweep there may be occasions when it is 
impossible to gain access because the door is locked or the telephone is 
enclosed in a box. Therefore, every sweep kit should include a lock- 
picking set. 
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Product Description 



Products 



Ref. 


Qtv 


Model 


Description 


1 


1 


7501 


NLJD Non Linear Junction Detector 


1b 




7501-2 


Advanced Non Linear Junction Detector 


2 


1 


7502-1 


TSCM Search Tool Kit 


3 


1 


7502-2 


Advanced /Telecomms Search Tool Kit 


4 


1 


7504 


Portable X-Ray System 


4b 


1 


7504 option 


Advanced Flat Screen X-Ray Imager 


5 


1 


7505 


Thermal - Wall Scanner 


5b 


1 


7505-2 


Thermal Imaging for Surveillance Applications 


6 


1 


7506 


Locator 


7 


1 


7507-01 


Optical System to Detect Cameras, Lens (Room Version) 


8 


1 


7508 


Advanced Scan Detector System 


9 


1 


7509 


TDR Multi Channel Cable Detector 


10 


1 


7510 


Digital Advanced Eland Held Oscilloscope 


11 


1 


7511 


Detection Receiver 


12 


1 


7513 


Wall Depth Measurement System 


13 


1 


7514-2 


video remote probe inspection 


14 


1 


7515 


Marking Kit-Covert Stickers Illuminator 


15 


1 


7516 


Optical Search Toolkit 


16 


1 


7517-01 


Video and Audio RF Detection System 


17 


1 


7517-02 


Advanced Video & Audio RF Detection System 


18 


1 


7518 oscor 


OMNI SPECTRAL CORRELATOR 


19 


1 


7518 option 


Omni Spectral Correlator 


20 


1 


3521 


High Power GSM Jamming System 


21 


1 


3522 


Room Jammer 


22 


1 


3525 


Computer Screening Jammer 


23 


1 


3526 


Anti-Laser-Microphone Noise Jammer 


24 


1 


3527 


Advanced Counter Surveillance Jammer 


25 


1 


7519 


FSH Portable Spectrum Analyzer 


26 


1 


7520 


Bug Detector 


27 


1 


7521 


EB200-High Speed Frequency Scanner 3 GHz with DF 
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Product Description Products 



28 


1 


7522 


Digital Scout Frequency Detector 


29 


1 


7523 


Advanced Cable Tracing System 


30 


1 


7525 


X-ray for Screening VIP Presents 


31 


1 


7527 


Encryption Product - GSM Encryption Phones 


32 


1 


7530 


Ultra Scan50b 


33 


1 


7539 


3D image enhancer 


34 


1 


7540 


Wireless Network detector 


35 


1 


7541 


Telephone Line analyzer Detector 


36 


1 


7542 


Secure document scanner 


37 


1 


7543 


LAN/WLAN Checking System 


38 


1 


7544 


TSCM Search Video Pole Camera 


39 


1 


7545 


Video Wireless Detection 


40 


1 


7546 


Cable Amplifier System 


41 


1 


7547 


Flat Panel X-ray system 


42 


1 


4014 


GSM Detection System 


43 


1 


1013 


Night Vision kit 


44 


1 


2001 


Door Opening kit 
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NLJD Non-Linear Junction Detector 



Model 7501 



Non Linear Junction Detectors (NLJD) are used in the initial physical search phase of a 
sweep. Its unique use allows an operative to quickly and effectively scan a location for 
concealed electronic components. 



The Model 7501 is a versatile third harmonic non-linear junction detector which detects, 
analyzes and pin-points the location of suspect electronic devices, whether they are switched 
on or off. 




TECHNICAL FEATURES 

• Channel selectable; four operating frequencies to ensure 
potential interfering signals are avoided, (FCC 915MHz, EU 
869MHz and classic 888MHz; Available in one unit for universal 
operation). The four spot frequencies are customer selectable 

• High Power Transmission to rapidly search a large area with 
greater penetration; adjustable power control 2mW to IWatt 
(2Watt optional) 

• Constant power transmission, as opposed to pulsed operation. 
(Continuous transmission reduces risk of missing a threat from 
inadvertent rapid movement of antenna head) 

• Unique 4-way thumb control conveniently placed on display 
screen for most commonly used functions 

• Ergonomic sweep head with increased sensitivity reduces 
search time, 6dBi gain 

• Circularly polarized antenna improves reliability, and reduces risk 
of missing a threat due to incorrect antenna polarization 

• Quick fit removable smart battery housed inside control module; 
provides over 2-hrs operation. 

• Minimum set-up time; extension Lengths 52-208 cm. 

• Robust, lightweight aluminum, fiberglass and carbon design; 
operational weight only 2kg; in transit case 5.6kg. 
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NLJD Non-Linear Junction Detector Model 7501 

THE MODEL 7501 MAY BE USED TO IDENTIFY: 

• Active or Live Bugs 

• Inactive Bugs 

• Turned On Bugs 

• Turned Off Bugs 

• Burned Out Bugs 

• Dead Bugs 

• Covert or Concealed Video Cameras 

• Microwave Transmitters 

• Remote Control or Remote Powered Bugs 

• Resonant Cavity Devices 

• Concealed Cellular, PCs, and GSM Telephones 

• Electronic Timers for Hidden Bombs 

• Wireless Microphones 

• Hidden Tape Recorders (even broken ones) 

• Covert Eavesdropping Devices 




EQUIPMENT CONTENTS: 

• Control Module 

• Display Module 

• Antenna Head 

• Battery Charger 

• 2 Re-chargeable NiMH Batteries 

• Earphones 

• 36 cm Extension Tube 

• Transit Case 



TECHNICAL DATA: 



TRANSMITTER 




Frequency range 


Four spot frequencies in the range of 869-916 MHz. (dependent on 
country of use) 


Power output 


Adjustable 2mW to 1W ERP (2 W optional) 


Filtering 


1 0 section filter 



CONFIDENTIAL 



2 





elaman P 

M»M*N (KUHTT igiUTIDNI V 



NLJD Non-Linear Junction Detector Model 7501 



Output connector 


50 ohm double screened co-ax socket 


RECEIVER (RX1) 

Frequency range 


1738 - 1832 MHz (transmitter selection controls receiver 

frequencies) 


Sensitivity 


Detection at -1 30 dBm. 


Filtering 


6 section filter 


Input connector 


50 ohm double screened co-ax socket 


RECEIVER (RX2) 




Frequency range 


2607-2748 MHz (transmitter selection controls receiver frequencies) 


Sensitivity 

Filtering 

Input connector 


Detection at -1 30 dBm. 

6 section filter 

50 ohm double screened co-ax socket 


DISPLAYS 


Target response/comparison 

Transmitter output power 

Battery level, mode selection (RX1 and RX2) 

Frequency selection, signal strength (R 1 and R2) 


CONTROLS 


4 way thumb control selects range and receiver selection 
Volume up and down, frequency select and ON/OFF 


ANTENNA 

Frequency coverage 
Gain 


860-920 MHz, 1720-1840 MHz and 2580-2760 MHz. 
6 dbi. 


Polarization 


RHC Right hand circular 


CHARGER 




Input voltage 


1 00-240 VAC. 


Charging current 


1200mA/auto trickle charge 


Charge time 


Up to 1 .5 hours 


Type 


Microprocessor controlled, short circuit and timer 


BATTERY 

Type 

Voltage 

Test 


Nickel metal hydride - smart battery 
10.8V DC/1700 mAh. 

Built in battery level indicator 


Run time 


2 hours - normal operation 
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Advanced Non-Linear Junction Detector Model 7501-2 

Non Linear Junction Detectors are used in the initial physical search phase of a sweep. Its 
unique use allows an operative to quickly and effectively scan a location for concealed 
electronic components. 



The Model 7501-2 provides the means to detect hidden electronic devices, regardless of 
whether the device is radiating, hard wired, or even turned on at all! Its unique design means 
that it is lightweight and completely portable as it folds away into its small case. 




Transmit ot 9 t 5MHi 
2nd Harmonic at 1 830MHz 



3rd Harmonic at 2745MHz 




TECHNICAL FEATURES 

• Minimum set-up time, no cables or bulky transceiver units to carry 

• Lightweight, balanced ergonomic design for ease of use 

• High transmit power for rapidly searching a large area 

• Circularly polarized antenna reduces search time and improves reliability 

• Dual harmonic with discrimination algorithms minimizes false alarms 

• Standard type camcorder battery with long use time and quick charge function 

• Wireless headphones and graphic display for simultaneous audio & visual information 

• 2nd and 3rd harmonic operation includes advanced algorithms for minimizing false alarms 
as well as listening capability for each harmonic 

• Dynamic power control for locating threats; automatic or manual control (10 mwatt to 1 
watt) 

• Synthesized transceiver provides frequency stability and agility to automatically search for 
clean operating frequencies (frequency range 902-928 MHz for US models and 850 MHz to 
1,000 MHz for export models) 

• Circular, polarized antenna removes risk of missing a threat due to incorrect antenna 
polarization 
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Advanced Non-Linear Junction Detector Model 7501-2 



THE ORION MAY BE USED TO IDENTIFY: 



• Active or Live Bugs 

• Inactive Bugs 

• Turned On Bugs 

• Turned Off Bugs 

• Burned Out Bugs 

• Dead Bugs 

• Covert or Concealed Video Cameras 

• Microwave Transmitters 

• Remote Control or Remote Powered Bugs 

• Resonant Cavity Devices 

• Concealed Cellular, PCs, and GSM Telephones 

• Electronic Timers for Hidden Bombs 

• Wireless Microphones 

• Hidden Tape Recorders (even broken ones) 

• Covert Eavesdropping Devices 

TECHNICAL DATA 

TRANSMITTER 

Frequency Bands: 880 - 1005 MHz using 200 

kHz steps. USA versions: 
902.2 -927.8 MHz. Foreign 
models are adjustable 
between 880 and 1005 
MHz. The unit is actually 
usable down to 850 MHz, 
but there is 1-2 dB of loss in 
off of the second harmonic. 




receiver sensitivity due to filter roll- 



Peak Power: 1 .4 Watts (effective radiated power including antenna gain and all 

system losses). 

Power Control: 30 dB range in 2 dB steps; Pulsed to limit average output power 

to FCC max. 



RECEIVER 

Frequency Bands: Second (1700-2010 MHz) or third (2550-3015 MHz) harmonic of 

transmit fundamental frequency. 

Sensitivity: -130 dBm for both Harmonics. 



Gain Control: The gain of the unit is enhanced using software integration. 

Various modes of operation have different integration algorithms 
for maximum performance. The gain is controlled by setting the 
level of integration using the SET key. 



Receiver IF BW: 3 kHz 

Unit Operational Weight: 3.4 lbs (1 .54 kg) 



Antenna Polarization: Circular for both transmit and receive functions. 
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Advanced Non-Linear Junction Detector Model 7501-2 

INFRARED HEADPHONES 

• Headphones can be plugged directly into main unit or plugged into the Infrared Receiver 

• Plugging headphones into the main Unit turns off the IR transmit function on the main 
unit 

• Plugging headphones into the IR Audio Receiver automatically turns on the IR Audio 
Receiver 

• Volume control is adjusted via the main Unit 

BATTERY SPECIFICATIONS 

• Externally rechargeable standard type battery 

• 7.2 VDC camcorder style NiCad 

• Run time 1 hour on full charge when operating at full power. Normal usage should result 
in run time hours 

BATTERY CHARGER 

• Dual battery charger with automatic operation 

• Charging time is approximately 45 minutes to 1 hour depending on battery vendor 

• Sequentially charges both batteries 

LED INDICATORS: 

• Flashing LED - charge pending (applies to the situation when two batteries are 
simultaneously placed in the charger) 

• Bright LED - fast charging 

• Dark LED - No battery or charge complete 

OPTIONAL 

Model 7501-3 - High power non-linear junction detector 
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TSCM Search Tool Kits 7502 series 



MODEL 7502-1: SEARCH TOOL KIT 

Once the NLJD has located a potential threat there are ways to verify the status of the 
potential threat. All tools required to aid in the classification of the potential threat are included 
within the NLJD toolkit. 



The TSCM Search Toolkit contains selected tools for verifying the existence of threatening 
electronic surveillance devices. This toolkit, which comes in leather tool bag, is uniquely 
suited for use with a Non-Linear Junction Detector. 

EQUIPMENT CONTENTS 

• Borescope with built-in light and right-angled viewer for inspecting inside walls, furniture, 

etc... 

• Wire tracing system to trace miscellaneous cables 

• Fluke multi-meter for testing miscellaneous cables and electronic devices 

• Combination stud finder and metal detector for non-destructive evaluation 

• Hammer to evaluate the stability of a junction under physical vibration 

• Ultraviolet light and marking pen 

• Multi-purpose geared screwdriver. Provides screwdriver function as well as small drill for 
use with borescope 

• Miscellaneous tools: pliers, wire cutters, leatherman (multi-purpose tool), inspection 
mirrors, measuring tape, flashlight, drill bits for walls, etc 
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TSCM Search Tool Kits 7502 series 

MODEL 7502-2: ADVANCED/TELECOMS SEARCH TOOL KIT 

Designed as a TSCM team toolkit, this model has all the necessary tools needed to carry out a 
thorough physical and cable search. Containing the basic toolset required for telephone 
sweeps, such as a Digital Multimeter, Butt Set and structured cabling tools, it compliments 
more advanced cable tools, such as the Line Amplifier or CPM700. All the electro mechanical 
tools in this set have been put together to provide a wide range of aids for completing a full 
physical search, such as work lights, mirrors, opening tools and even a drill to allow use of 
borescopes or videoscopes. 



The Advanced Search Toolkit includes the recommended TS30™ DataSafe® Lineman's Test 
Set, Fluke 177 backlit true-rms DMM with extended capacitance range and DeWalt DW980k-2 
Heavy-Duty Cordless 3/8" Drill/Driver Kit with extended run-time batteries. The versatile kit is 
designed for contractors who demand the highest quality and most complete tool assortment. 
Use the Advanced Search Toolkit to service and install voice and data circuits, phone switches, 
datacom networks, computers, telephone packets and virtually anything integrating voice and 
data. Wrap and unwrap wire terminals, trace and troubleshoot wires, punch 1 10 and 66 blocks 
plus pull wires through conduit. 



The name-brand tool selection includes Cementex 1000-V screwdriver and channel lock pliers, 
Klein cushion-grip screwdrivers and nut-drivers, a Fluke voltage detector, fluorescent work 
light with extension cord, leather gloves, stapler and staples for RG-59 and RG-6 coax, plus 
more. 



Our robust black polyethylene case features reinforced construction, extra-large corners, steel 
spring-loaded handles and quarter-turn latches. This is the only hard case kit with a built-in 
DMM pouch. The 35.6-pound SPC21-96 is 17.75" x 14.5" x 9" (inside dimensions). Empty 
082X471 case also may be ordered separately. 




CONFIDENTIAL 



2 



elaman P 

M»M*N (KUHTT SQIUTHQNB V 



Portable X-ray System Model 7504 

One of the biggest threats in TSCM is the miniaturization of technology allowing very small 
eavesdropping devices to be well concealed. It is imperative all items which cannot be cleared 
safe with the naked-eye be passed through the Portable X-Ray System. 

The digital X-ray system allows an operative so see inside any item allowing a non destructive 
detailed physical inspection. 

The digital X-ray system is easily set up and deployed in minutes by one person and can be 
configured to suit different environments. 

It comes with a choice of x-ray sources, adjustable exposure settings, different size ICUs and 
has both wireless and ROV capabilities. 




FEATURES 

• search and examine suspicious objects on the spot 

• portable, easy to set up and use in 2 minutes 

• image analysis includes zoom, reverse black and white, pseudo-color, pseudo 3D and 
measure, show gradients, rotation, distance, contrast enhancement and more 

• image print and email 

• archive in excess of 32,000 images on PC or CD 

• annotation tools 

• full database management tools 

X-RAY STANDARD CONFIGURATION: 

• Lightweight X-Ray Generator 

• Laptop PC 

• Image Capture Unit (ICU) 

• Transportation Case 

• 50 Meter Cable Drum and Optional Wireless Control 

• Spare Generator Battery 

• Battery Charger 

• Instruction Manual 
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Portable X-ray System Model 7504 

MODEL 7504 IMAGE CAPTURE UNIT (ICU) 




Standard Image Area 


8X10" (20.32 X25.40 cm 
Optional: 10x13" 
custom sizes available 


Camera Type 


High Performance CCD 


Horizontal 

Resolution 


625 TV lines 


Video Signal/Noise 


Better than 40 dB 



X-RAY GENERATOR 




Option 2 


XR200: 2 kg with battery 
150kV maximum energy 




Penetration: 15 mm steel 




5.5 kg with battery 
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Advanced Flat Screen X-ray Imager 



7504 option 



The Model 7504 option - more coverage, more rugged and more reliable than the rest! 

Model 7504 option is an innovative flat panel x-ray imager from us. The unique flat panel 
design gives high resolution images, in the most confined spaces, from different orientations 
and with even greater coverage (25 x 33 cm). 

Model 7504 option was specifically designed for security and law enforcement professionals 
and is flatter, safer, stronger and less expensive than many other fragile flat panel units. It 
utilizes all the features of the Model 7504 image processing software to produce high 
resolution x-ray images. It is available as a complete x-ray system or a single flat panel 
upgrade. 




Some great reasons why to invert or to upgrade your old conventional x-ray unit to Model 
7504 wedge 















High Resolution Images 

Flatter 

Safer 

Stronger 

Faster 

50% more coverage 

More rugged in the field 
Less expensive 
More versatile 



Utilizes Elaman's powerful imaging software 
Substantially slimmer than conventional units 
No re-approach to suspect objects 
No mirrors, and fewer fragile components 
High quality images straight to pc. No reapproach, no 
scanning, no developing required 

25 x 33 cm (10 x 13"). Complete x-ray system fits in a single 
case 

Specifically designed for Police and EOD operations 
No film, no consumables, fewer fragile components 
Tri-directional. Use upright or slide in from either side 



The Model 7504 option is available as a complete flat panel x-ray solution and/or as an upgrade 
to Golden portable x-ray systems currently using: 

• Costly Polaroid Film or Image Processors 

• Conventional CCD imaging Boxes 

The Model 7504 option integrates with Elaman's imaging software to produce high resolution 
x-ray images. 



CONFIDENTIAL 



1 








elaman P 

M»M*N (KUHTT igiUTIDNI V 



Advanced Flat Screen X-ray Imager 


7504 option 


DIMENSIONS: 




Imaging Areas: 


25.4x33 cm (10" x 13") 


(a) Depth (bottom): 


2.9 cm (1.1") 


(b) Depth top of panel: 


3.7 cm (1.45") 


(c) Depth at domed area (above screening area): 


1 1 .4 cm (4.4") 


Width: 


34.4 cm (13.5") 


Height: 


93.2 cm (36.6") 


Please note all dimensions are approximate 






Wall 



Images sent immediately to pc 
from the Flat panel- no scanning 
required 



tray Imager 



(b) 



I (a) 

Side view 




Front view 




PC control unit 



X Ray generator 
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Thermal Wall Scanner Model 7505 

A physical inspection of a target location is the most time consuming part of a sweep. All 
surfaces and objects must be inspected. In order to perform a quick and thorough search the 
Model 7505 has been developed to help locate concealed eavesdropping devices. A 
concealed device will emit a heat signature easily spotted by the Thermal Inspection System. 



The Model 7505 is an ultra-compact 
infrared CCD camera, which provides 
advanced and superb image quality, while 
offering portability and exceptional cost 
performance. Because it is very small and 
lightweight, the optional battery-powered 
camera can be used in very narrow and 
difficult to reach places. Furthermore, it 
allows imaging while walking. The system 
comes with a number of options, e.g. an 
LCD-display which can be removed from 
the camera itself and a memory card slot 
for file storage. 



Visual Image Thermal Image 




Video Camera 



USAGE 

The Model 7505 detects "Hotspots" 
quickly and reliably. "Hotspots" are very 
small warm areas generated by bugging 
surveillance equipment used for 
eavesdropping, often placed in walls, 
ceilings or furniture. 

Any change in the heat structure of 
objects can be detected by using the 
Model 7505. 




Ashtray Ashtray Transmitter 



FEATURES 

• Ultra compact IR-camera kit system 

• Various accessories 

• Digital zoom function with flexible optical 
objective performance 

• File-storage inside the camera using the 
optional PCMCIA drive 

• Camera protection against environment 
influences by using an optional suitable caver 

• RS-232 online control with command 
software 

• TFT color LCD-display with 256 true-color 
display-integrated control buttons, optional 
cable extension 

• Integrated long-life sterling cryocooler with whispering run 

• Digital interfacing corresponding with the PCMCIA, PCI and DRVURBS PC-connection 
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Thermal Wall Scanner Model 7505 

SPECIFICATIONS 



Measuring range 


Range 1 D20 to 1 00 j C 


D40 to 1 20 j C 


Range 2 0 to 250 j C 


0 to 500 j C 


Range 3 (option) 1 00 to 800 j C 


200 to 2000 j C 


Range 4 (option) 200 to 2000 j C 


N 


Resolution 


0.06 j C (at 30 j C 60Hz) — range 1 


Accuracy 


±2j C or ±2% of reading 


Spectral range 


8 to 14pm 


Focusing range 


30 cm to infinity 


Field of view 


21 .7 j (H) x 1 6.4 j (V) 


Frame time 


60 frames /sec 


Thermal image pixels 


320 (H) x 240 (V) pixels 


A/D resolution 


14 bits 


Measuring functions 


Run/Freeze 


Interval measurement 


Recording on memory card : 2 to 3600 sec interval 
Trigger function 


Emissive correction 


0.10 to 1 .00 (at 0.01 step) 


Storage device 


Compact flash memory card for: 




Thermal image in S IT or BMP file format 




Visible image in S IT or JP E G file format 


Movie recording 


Real-time memory : 1664 images (max. 60Hz) 


Video signal output 


NTS C/PAL composite video signal, S -video 


Interface 


IE E E 1394, R S-232C 


Operating temp/humidity 


D15 to 50 j C, 90% R FI or les s (not condensed) 


Storage temp./humidity 


D40 to 70 j C, 90% R H or les s (not condensed) 


Power supply 


AC adaptor : 100V to 240V, DC 7.2V (nominal) 


Power consumption 


Approx. 6W (typ) 


Shock and vibration 


294m/sec2 (IE C60068-2-27), 29.4m/sec2 (IE C60068-2-6) 


Environmental protection 


IP 54 (IE C60529) 


Dimensions 


Approx. 108 (W) x 1 13 (H) x 189 (D) mm (excluding projection) 


Weight 


Approx. 1 ,3kg (excluding battery and LCD) 




Approx. 1.6kg (including battery and LCD) 


Standard accessories 


AC adaptor, battery pack (2pcs ), battery charger, compact 
flash memory card, grid belt, neck s trap, lens cap 
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Thermal Imaging for Surveillance Applications Model 7505-2 



HANDHELD IMAGER FOR LAW ENFORCEMENT 

Traditionally, thermal imaging is used by law enforcement helicopters and specialist teams. 

The Model 7502-2 has been identified as a cost effective 
solution for all law enforcement operations and has been well 
received by various Police Forces worldwide after trials within 
TSU, Firearms and other teams. 

• Surveillance 

• TSCM Operations 

• Recently used vehicle detection 




THE IMAGER UNIT 

An innovative handheld thermal imager that offers 
outstanding imaging performance, together with flexibility 
and ease of use at minimal cost. 



This handheld unit delivers 
affordable thermal night 
vision for many practical 
law enforcement uses. 





Technical details 

• Large clear display 

• Simple operation 

• Weighs just ,75kg 

• Lowest cost high definition imager on the market 

• 1 50+ m image range 

• Image storage to SD card 

• Temperature measurement ideal for hydroponics 

• 160 * 120 image 

Range of options and accessories 

• Car and desk chargers 

• Unit with higher image updating speed 
frames/second) 

• Unit with twice the image range (250+ m) 



Proven Technology 

The technology within this 
small unit has been used 
in industrial and 
commercial applications 
for over a decade. 
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Thermal Imaging for Surveillance Applications Model 7505-2 

SURVEILLANCE APPLICATIONS 




Detects people in total darkness and allows covert distance surveillance 



• Covert Surveillance 

• Monitoring of arrivals and departures 

• Monitoring of open areas 

• Safer parks initiatives 

In darkness, thermal imaging gives the ability to "see" in zero light conditions proving valuable 
in many situations. 

Surveillance features include 

• High resolution 160x120 pixel image 

• Large clear screen 

• Auto hotspot tracker - useful for highlighting people 

• Selectable color palettes 

• Digital x2 zoom 

• Optional screen shade to prevent light emission/reflection image storage to SD card 

An important tool for "sweeping" buildings 

For non-alerting bug detection, the unit provides measurement of surface temperatures and 
visible indication of irregularities. 

Where a listening device/bug is working, it may alter the temperature of the adjacent 
material/wall. 

• This temperature difference will be shown as a "hot spot" 

During a house search, the unit can be used at arm's length to scan cupboards, difficult to 
reach places, lofts and hatches, etc. 

• A picture is taken first, then unit is withdrawn so the image can be looked at before the 
officer enters the confined space 

Firearms teams have successfully been using this unit during recent exercises and operations. 

SCOPE OF DELIVERY 

The unit comes with 

• Camera and rechargeable battery 

• Wrist strap 

• Carry case 

• Charger 

• Software on CD 

• SD Memory card/SD memory card reader 
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Locator Model 7506 

LOCATOR RADIO MICROPHONE DETECTOR 
THE RF NEAR FIELD COMPONENT 

The Model 7506 was developed for counter electronic surveillance. Its primary requirement 
was to be able to covertly detect clandestine Radio Microphones that could effectively be 
used by both non-experienced and experienced counter measure personnel. Its performance 
therefore had to be independent of the local RF environment, a domain where many previous 
instruments failed. 

The result is Model 7506, which is a differential broadband "H" field detection system, has 
the following specifications: 



TECHNICAL 



Frequency Range 


25 MHz - 4 GHz and beyond 


Detection capabilities 


All types of Radio Microphone including "Smart" bugs, such as 
frequency hopping and spread spectrum. 


Audible Warning 


SONAR or Listen (demodulation) modes, via closed headphones. 


Visual Warning 


Field strength with direction finding read out 



PHYSICAL 

Hand held with an antenna system mounted on a telescopic boom. The antenna head is 
detachable for easy storage in a custom foam-lined case. It is supplied with high quality closed 
headphones. 
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Optical System to Detect Cameras, Lenses Model 7507-01 

The Model 7507-01 camera detector is a small device, which enables you to quickly and 
effectively detect hidden cameras. 

When sweeping the designated premises (study, living room, office etc.) with the device, 
keep in mind that a pin-hole camera is always aimed at a certain zone, a bed, a table etc., 
where it is easier to observe people. Stay in these zones when sweeping the room with the 
device. 

Cameras may be fixed not only to the walls or ceiling, but into the interior of some objects like 
clocks, lamps, fire and safety sensors, files for documents, sockets, switches etc. 

Several cameras may be installed, that is why after detection of one camera, continue to 
sweep the room with the device in different directions. 

The best operating distance when sweeping a room is 2-4 m. 

When sweeping surfaces and objects with the device, gently move the observation zone up 
and down. 

When inspecting an area with reflecting surfaces (mirrors, polished furniture etc.), always 
position yourself so that there is no direct reflection between you and the mirrored surface. 
This will stop the direct back-reflection of laser emission and light in the eye-piece. 
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Advanced Scan Detector System Model 7508 

DESCRIPTION 

The Advanced Scan Detector System, Model 7508, is uniquely different from all other RF 
Detection Systems. It is an advanced system which uses spectrum analyzer with the latest 
software technologies to provide accurate results. It uses a twin antenna system, placing one 
antenna outside the target location and one inside. Using the software it is able to show all 
suspicious transmissions which are stronger in the target location than outside. This is a 
strong indicator of a transmitting eavesdropping device. 




USAGE 

Today's advanced bugs can use digital-burst transmission, including low power, making it 
extremely difficult to detect with standard spectrum analyzers. The Model 7508 compares the 
RF activities inside a danger area with the spectrum outside. By using the software options 
there is an "online" possibility to detect all kinds of newer RF bugs, also "low power devices", 
burst- or spread spectrum-transmissions. 

FEATURES 

• Measurements possible between 9 kHz and 26.5 GHz 

• Switchable increase of input power 

• Inputs and outputs for video signals with BNC connectors 

• 6" TFT-Display 

• Smallest spectrum analyzer of its kind 

• Practical shoulder belt 

• Rubber protections 

• Optional differential spectrum analyzing software with additional antenna and switching 
hardware 

• The differential software up the 7508 enables 24-hour detection and location of any 
transmitter's radio surveillance earphone 



CONFIDENTIAL 



1 





elaman P 

M»M*N (KUHTT igiUTIDNI V 



Advanced Scan Detector System Model 7508 



TECHNICAL DATA 



Basic Unit 




Frequency range: 


9 kHz to 26.5 GHz 


Resolution bandwidths: 


1 kHz to 3 MHz 




5 MHz in Function ZS 


Phase noise: 


-1 00 dBc/Hz to zu 3 GHz 


Noise floor down to: 


-145 dBm at 100 Hz RBW 


Tracking generator: 


2.2 GHz 


Output level: 


-31 to 0 dBm in 1 dB S. 


Input level: 


+ 27 dBm 


Storage media: 


2 PCMCIA-Slots 


Power: 


- 230 V Netzteil 




- Akku-Pack (max. 1 ,5 h) 




- 12 V DC 



OPTIONS 




with Option 26: 


100 Hz und 300 Hz 


with switched-on pre amplifier with a gain of >25dB 


with Option 74: 


2.7 GHz 
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TDR Multi-Channel Cable Detector Model 7509 

The TDR is one of the most valuable TSCM test instruments available. This equipment is 
capable of detecting many wiretap methods that are undetectable by conventional telephone 
analyzers, meters or other instrumentation. 

The TDR is designed to reveal all wire irregularities (impedance mismatches) by displaying the 
characteristic signatures and distances to each wire irregularity. Without a TDR, the presence 
and location of all wire irregularities cannot be pinpointed, and therefore will not be physically 
inspected. This can also establish possible previous wiretap activity, or modifications intended 
for future use. Since many wiretap operations are fairly short-lived, this information can be 
extremely important. Without a TDR, the TSCM technician would be unable to detect hidden 
parallel bridge taps, split/resplit inductive wiretaps, mini-taps or other forms of clandestine 
telephone line modifications. 

USAGE 

The TDR can quickly, safely and reliably locate the following cable 

• Inductive line tap 

• Capacitive line tap 

• Split/resplit 

• Disconnections 

• Illegal wire tapping 

• Short circuits 

• Alteration of impedance 

• Change of pairs 

• Return loss 

• Intermitting faults 

FEATURES 

• Tests both twisted pair and coaxial cables 

• Superior fault location in any industry and any application 

• Sub-nanosecond pulse width in coaxial mode locates small, often unsuspected, faults 
that are close together 

• RANGE-PLUS simplifies keypad operation by combining a specific pulse width, vertical 
gain, and cable length 

• Live waveform testing 

• Intermittent Fault Detection (IFD) mode detects and displays intermittent faults and 
allows the operator to manipulate and reposition the waveform without affecting the 
IFD function 

• Noise filters eliminate unwanted waveform noise 

• Rugged, weatherproof packaging 

• Portable, compact, lightweight 



TECHNICAL DATA 



Measurement range: 


10 m to 19.4 Km 


Pulse width symmetrical: 


2ns, 25ns, 100ns, 1ms, 6ms 


Pulse width coaxial: 


0.9, 5, 25, 100, 500 ns 


Precision, symmetrical: 


+/- 0.15m + 0.01 % v. MW 
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TDR Multi-Channel Cable Detector Model 7509 



Precision, coaxial: 


+/- 0.03m + 0.01 % v. MW 


Max. resolution: 


0.1 m at v/2 


Handling: 


One function per button 


v/2 adapting: 


m/ms from 48 to 148 


Adapting: 


various 


Waveform storage, standard: 


8 waveforms 


Waveform storage, optional: 


32 waveforms 


Input protection: 


400 volts (AC + DC) from DC to 400 Hz and 
decreases to 10 volts at 1 MHz 


Serial I/O port: 


RS-232 


Display: 


320 x 240 dot matrix liquid crystal display (LCD) with 
CFL backlighting 


Power source: 


internal, rechargeable 7.2 nickel metal hydride 


Charging source: 


external 1 2 VAC, 1 .3 A 


Operating time: 


>6 h continuous without backlight 


Operating temperature: 


32 dF (0°C) to 122 dF (50°C) 


Typical temperature: 


5dF (-1 5°C) to 140 dF (60°C) 


Storage temperature: 


-4 dF (-20°C) to 140 dF (60°C) 


Humidity: 


95 % max. relative humidity non condensing 


Dimensions (W x D x H): 


9.75 in x 5 in x 10.5 in/247.6 mm x 127 mm x 267 
mm 


Weight: 


6 lb (2.7 kg) 
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Digital Advanced Handheld Oscilloscope Model 7510 

DESCRIPTION 

The Model 7510 includes a multifunctional measurement system with oscilloscope and 
millimeter facilities. Furthermore, it has a built-in paperless writer. The rechargeable NiMH- 
battery packs guarantee a usage of 4 hours (AC-independent) work and are able to be 
recharged within 4 hours. With its several automatic power saving possibilities, the Model 
7510 can last all day. 

USAGE 

The Model 7510 is an important tool to handle all the different 
basic measurements for 

• TC (Telecommunication networks) 

• DC (Data communication networks) 

• ACS (Access control systems) 

• FDS (Fire detection systems) 

• IDS (Intrusion detection systems) 

• EIB (European installation bus) 

• BBTV (Broadband television) 

FEATURES 

• Dual input, available with 60, 100 or 200 MFIz bandwidth 

• Up to 2.5 GS/s real-time sampling per input 

• mAs current-over-time measurement 

• Connect-and-View™ automatic triggering, a full range of manual trigger modes plus 
external triggering 

• 30,500 points per input record length using Scope Record™ mode 

• Automatic capture and replay of 1 00 screens 

• 24 automatic waveform measurements 

• Courser, zoom and real-time clock 

• Four hour rechargeable NiMH battery pack 

• 1,000V CAT II and 600V CAT III safety certified 

• Up to 1,000V independently floating isolated inputs 

• Includes a 5,000 count true-rms multi meter and a Trend Plot™ paperless recorder 

e software helps you get more out of your scope meter by 

Documenting: transfer screens, waveforms and 

measurement data from the scope meter to your PC for 
printing, or to import data to other programs 
Archiving: Store and retrieve waveforms with text 
annotations and create your own library for easy 
reference and comparison 

Analysis: gather valuable measurement data and 
enable cursor measurements to reveal relationships and 
conditions 
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Digital Advanced Handheld Oscilloscope Model 7510 



TECHNICAL DATA 

Bandwidth 


Fluke 199C, 199B: 200 MHz 


Max. real time sample rate 


2.5 GS/s 


Display 


144 mm Full Color LCD 


Digital Persistence 


Yes, Gives analog oscilloscope like waveform decay (user 
selectable) 


FFT Analysis 


Frequency spectrum analysis using mathematical function 
Fast Fourier Transform (FFT) 


Envelope mode 


Yes 


Waveform Compare 


Visual Reference and Automatic Pass/Fail testing 


Max. record length 
a ; in Scope mode: 


3000 points per input channel 


a ; in Scope Record mode: 


27,000 points per input or more (5 ms/div to 2 min/div.) 


Number of inputs 


2 plus external / DMM input, all isolated from each other 
and from ground 


Number of digitizers 


2 


Independently floating 
isolated inputs 


Up to 1000 V between inputs, references and ground 


Glitch capture 


Up to 3 ns using Pulse Width triggering; 50 ns peak 
detect at 5 ms/div. to 1 min/div. 


Time base range in Scope 
mode 


5 ns/div to 2 min/div 


Trigger types 


Connect-and-View®, Free Run, Single Shot, Edge, Delay, 
Video Frame, Video line, Selectable pulse width and 
External 


Advanced Trigger Types 


N-Cycle Trigger. Delay Trigger by N events 

Dual Slope Trigger. Trigger on both rising and falling 
edges of waveform 


Scope Measurements 


7 cursors measurements, 30 automatic measurements 
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Digital Advanced Handheld Oscilloscope Model 7510 



Cursor-limited Automatic 
Measurements 


Vrms or Wavg automatic measurement within cursor 
defined time limits 


Scope-Record Trigger modes 


Start on Trigger, Stop on Trigger 


Capture last 100 screens 


Automatic, with Replay capability 


Dual input Trend Plot 


Yes, with Cursors and Zoom 


Memory for screens and set- 
ups 


10 screens with set-up 

5 more memories are made available upon registration of 
the Scope Meter 


Memory for recordings 


Two, each can store 100 scope screens, a Scope Record 
or a Trend Plot 


True RMS multi meter 


5000 counts. Volts, Amps, Ohms, Continuity, Diode, 
Temp 


Battery (installed) 


4 hr Ni-MH BP190 


Line power 


Adapter / battery-charger included 


Size 


25.6 x 16.9 x 6.4 cm (10.1 x 6.7 x 2.5 inch) 


Weight 


2 kg 


PC and Printer interface 


Using optional Optically Isolated RS232 adapter/cable 
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Detection Receiver Model 7511 

One of the first tools to be used during a physical search should be the Detection Receiver. 
This versatile unit can indicate the location of a transmission source, whether hidden in phone, 
room or body transmitters, remote control signals, computer bugs, fax or telex transmitters, 
video transmitters, pulsed tracking transmitters, spread spectrum, and even wide band 
frequency hopping or 'burst' transmitters. This is a multi use tool which covers a wide range of 
tasks from basic physical searches to cable verification. 

BROADBAND DETECTOR ADVANTAGES 

Portable Sweep Kit - provides everything needed to perform a professional sweep; fits inside 
a standard briefcase. 

Multi-Functional Utility - Comes with probes to detect RF transmitters (audio and video), 
carrier current transmitters, and telephone bugs. Probes are also available to detect for 
infrared transmitters, tape recorders, and acoustic leakage. 

Wideband Coverage - From 200Plz to over 3GPIz with no holes or gaps. 

Monitor Mode - After a sweep, the alarm monitor (silent or audible alert) guards against new 
devices brought in or remote control activation of surveillance devices. 

Auxiliary Audio Input - Allows user to listen to telephones or lines for "hotmikes," hookswitch 
by-pass and "infinity" bugs. Unknown wires and cables can be tested for wired microphones. 




TECHNICAL SPECIFICATIONS 
R.F. PROBE: 

• Gain: 20dB nominal frequency 

• Response: 50kPlz-2GPIz ±3dB 3GPIz-10dB 

• Sensitivity: -62dBm (1 segment) -85dBm M.D.L. 

VLF PROBE: 

• Frequency Response: 1 5kHz-1 MHz-3dB 

• MAX input voltage: 300 VAC 50-60Plz 

• Isolation: 1500 VAC 60Hz 

• Sensitivity: -38dBm (1 segment) -60 M.D.L. 
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Detection Receiver Model 7511 

AUDIO AMPLIFIER: 

• Input Impedance: 50K Ohm balanced 

• Input Range: 1 ,7uV-10V (135dB) AGO 

• Dynamic Range: lOOdB (high and low gain) 

• Frequency Response:100Hz- 15kHz±3dB (filtered) 500Hz-24dB/octave, 2.5kHz- 
18dB/octave 

• Headphone Output: 5Vp-p 220 Q 

• Record Out: 25 mVp-p nominal with AGC 

DISPLAY: 

• LCD Bargraph: 18 segment with pulsing single segment trip point 

• 50dB Dynamic Range (1 segment High Gain to MAX Low Gain) 

• Alert Output: 2.8kHz tone or silent red LED at 2Hz 

• Remote Output: N.O. contact (300mA 25V MAX) 

BATTERY: 

• 8 ea. MN1500 AA Alkaline - Life 1 0-1 6 hrs 

• (Optional) 8 ea. 550mAh NiCad - life 3-5 hrs per charge 

• Low Battery Indicator: approx. 10% remaining power 

AC ADAPTER/CHARGER: 

• Input: 95-I30VAC 50-60Hz, or 200-275VAC 50-60Hz 

• Output: 12VDC with 500mA NiCad Recharge Time: 8-10 hrs 

CPM-700 UNIT: 

• Size: 9 1/8x6 1/8x1 3/4 in, 23.2 x 15.6 x 4.4 cm 

• Weight: 39 oz, 1.1 kg 

CARRY CASE WITH ALL STANDARD ITEMS: 

• Size: 1 6 3/8 x 1 1 1 /4 x 3 in, 41 .6 x 28.6 x 7.6cm 

• Weight: 7 lbs, 3.1 8 kg 
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Wall Depth Measurement System Model 7513 



DESCRIPTION 

The Model 7513 is a metal detector using a 
visual display to control iron inlays inside 
walls, floors or ceilings. The results of this 
easy-to-handle positioning and measurement 
system are based on electromagnetic effects 
which are shown on an LCD Screen. 

USAGE 

Model 7513 is used to produce 
information of length, width, depth, position 
and quality of iron inlays in concrete and 
other ferromagnetic metals inside closed 
materials. This metal detector allows for a 
speedy visual search for hidden bugs inside 
buildings 

FEATURES 

• Easy analysis of iron material inside walls, floors or ceilings by using a visual display 

• Zoom function 

• Measurement information of the depth 

• Picture processing possible by: 

--Import in Word 

--Output to an external printer 

• Less height of the probe 

• Delivery in a strong tool case with accessories 




TECHNICAL DATA 



Speed of measurement: 


0.5 m/s 


Max. depth: 


180 mm 


Amplifying of width: 


between 6 to 36 mm 


Max. sphere of measurement at one run through: 


600 mm x 600 mm 


Working temperature: 


between -1 0°C to +50°C 


Size of probe: 


230mm x 133mm x 140mm 


Size of monitor: 


270mm x 195mm x 80mm 


Max. sphere of measurement without download: 


15m 2 



CONFIDENTIAL 



1 




elaman 

NH V / 



OF*u*N KtUlITT igiUTIDNI 



TSCM Video Remote Probe Inspection 

PRODUCTIVITY TOOL 

For TSCM search operational comes a revolutionary new video 
borescope - the Video Probe Remote Visual Inspection System - a 
power tool for improving tscm inspection productivity. 



FEATURES 

• Extra-bright, high-resolution LCD screen and high-output 
illumination deliver sharp, clear images 

• Dual-purpose shipping and operating case 

• Lightweight wireless remote control (optional) 

• Powerful computing platform for data management and worldwide 
connectivity 



Model 7514-2 




QUICKCHANGE™ PROBES 

With its interchangeable QuickChange probes, the Video Probe Remote Visual Inspection 
system quickly reconfigures probe diameter and length for maximum 
productivity. 



Probes come in 3.9 mm. 6.1 mm, and 8.4 mm diameters. The 6.1 
mm probes are built for increased durability with: 

• Titanium camera head that is 8 times stronger than older 
designs 




• Laser-welded bending neck seam which strengthens a critical joint 

• A double tungsten braid insertion tube for added crush resistance 



SYSTEM 

The base unit is a portable workstation for inspection data 
management, as well as a light source and storage reel for the probe. 
The unit features: 

• 512 MB (standard) up to 4 GB (optional) internal 

CompactFlash® card 

• 3 USB 2.0 ports 

• 1 0/1 00 Ethernet port for PC with optional Internet connection 

• Optional battery/UPS pack in one- or two-hour capacities 

• Two PC card slots that accept memory and communication 
cards 




• User configurable NTSC/PAL video format selection 
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TSCM Video Remote Probe Inspection Model 7514-2 

TECHNICAL SPECIFICATIONS 



OPERATING ENVIRONMENT 


System Operating 

Temp: 


-4° to 115°F (-20° to 46°C) LCD requires warm-up period below 
32°F (0°C) 


Tip Operating Temp: 


-13° to 176°F (-25° to 80°C) Reduced articulation below 32°F (0°C) 


Storage Temperature: 


-13° to 140°F (-25° to 60°C) 


Relative Humidity: 


95% max, non condensing 


Waterproof: 


Insertion tubes are watertight to 1 bar (14.5 psig, 10.2 m [33.5 ft.] 
of H20) 


Hazardous 

Environments: 


Not rated for use in hazardous environments 


SYSTEM 




Case Dimensions: 




Standard: 


54.6 x 49.5 x 32.0 cm (21 .5 x 1 9.5 x 1 2.6 in.) 


Tall: 


54.6 x 60.9 x 32.0 cm (21 .5 x 24 x 1 2.6 in.) 


Weight: 




In Case: 


21.8 kg (48 lbs.) 


Without Case: 


10.9 kg (24 lbs.) 


QUICKCHANGE™ PROBES 


6.1 mm (0.242 in.) and 8.4 mm (0.331 in.) Diameter Probes 


Image Sensor: 


1/6" Color SUPER HAD CCD® 


Pixel Count: 


440,000 pixels 


Temperature Sensor: 


Integrated Temperature Warning System 


Camera Housing: 


Titanium 


Articulation: 


360° All-Way® 


Tip Optics: 


Double threaded attachment 


3.9 mm (0.154 in.) Diameter Probes 


Image Sensor: 


1/10" Color, SUPER HAD CCD 


Pixel Count: 


290,000 pixels 


Camera Housing: 


Titanium 


Articulation: 


360° All-Way 


Tip Optics: 


Double threaded attachment 


HANDSET 




Dimensions: 


39x 18x 13cm (15.4x7.1 x5.1 in.) 


Weight: 


1.81 kg (3.98 lbs.) 
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TSCM Video Remote Probe Inspection Model 7514-2 



Construction: 


Polycarbonate housing with integrated elastomer bumpers 


LCD: 


16.3 cm (6.4 in.) diagonal, 16x9 aspect ratio, 800 x 480 pixels, 
wide VGA 


LCD Brightness: 


380 nits (cd/m2) 


Power Tube: 


2.4 m (8 ft.) long 


User Controls: 


Joystick and complete button function set 


Microphone: 


Built-in microphone for audio annotation located on the top center 
of the handset 


BASE UNIT 


Dimensions: 


44 x 22 x 35 cm (1 7.3 x 8.7 x 13.8 in.) 


Weight: 


7.21 kg (15.90 lbs.) 


Construction: 


Aluminum chassis with polyurethane bumpers 


System CPU: 


Intel Pentium ® M 


Video Processors: 


Multiple digital signal processors 


Brightness Control: 


Automatic and variable, adjustable auto gain and exposure 


System Memory: 


Internal CompactFlash® card, 512 MB (standard) to 4 GB 
(optional) 


Lamp Type: 


75W FHigh Intensity Discharge (HID) 


Lamp Output: 


4300 Lumens 


Lamp Life: 


1 000 hour median 


Keyboard Input: 


USB keyboard with built-in trackball 


Video Outputs: 


Switchable NTSC/PAL S-Video, Standard 15-pin PC video 
connector 


Video Input: 


Auto detecting NTSC/PAL S-Video 


USB: 


Three external USB 2.0 ports 


Ethernet: 


Integrated 10/100 Ethernet port 


PCMCIA: 


Two 32-bit PC card slots 


AC Input: 


AC Nominal input: 100 to 240 V, 50 to 60 Hz; 


115 V, 400 Hz; 275 W max 


AC Output: 


100 W max; IEC320-2-2 Type F connector 


AC Fuse: 


6.3A, 250V, fast acting 


DC Input: 


11 to 1 5 VDC; nominal 1 2 VDC; 1 50 W max 


DC Fuse: 


20A, 600 VDC, fast acting 


Audio Output 

Connectors: 


Built-in front panel speaker, 


3.5 mm stereo line level out, 2V RMS max, 


3.5 mm stereo headphone 
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TSCM Video Remote Probe Inspection Model 7514-2 



Audio Input Connector: 3.5 mm microphone 


TIP ARTICULATION 


Length 


Straight Tube 


4.5 m and less 


Up/Down - 150° min, Left/Right - 150° min 


6.0 m 


Up/Down - 1 30° min, Left/Right - 1 30° min 


8.0 m 


Up/Down - 1 20° min, Left/Right - 1 20° min 


9.6 m 


Up/Down - 90° min, Left/Right - 90° min 



INSERTION TUBE 



optical tip adaptor 



double threoded tip 



titanium construction 




loser welded Joints 

polyurethane outer layer 



tungsten wire braid tungsten wire braid 

steel monocoll 




polyurethane 
Inner layer 



4 articulation cobles/flber-optlc 
lighting cables/video cobles 






. 



Camera Head 



Insertion Tube • 



TECHNICAL SPECIFICATIONS 
SOFTWARE 



Operating System: 


Multitasking with desktop software options 


User Interface: 


Drop-down menu driven operation, joystick, and keypad 


File Manager: 


File and folder creation, naming, copying and deleting 


Audio Data: 


PC compatible, 15 second files (WAV or MP3 format). PCM audio 
with MPEG2 video recordings 


Image Controls: 


Adjustable brightness, 1/10,000 sec to 12 sec exposure. 
Left/Right invert for side-view tip correction. Freeze frame, 
live/still lnverse+ enhancement, side-by-side split screen 


Digital Zoom: 


IX to 3X - Continuous and 5-level stepped 


User Available Memory: 


100 MB internal, user-supplied external 


Annotation: 


Text and arrow overlays and custom logos 


Articulation Controls: 


360° All-Way® steering, Steer-and-Stay™, Home 


Lamp Control: 


On/Off, menu-controlled 


Software Updates: 


Field upgradeable via removable media 


Temperature Warning: 


Integrated camera and base unit temperature warning systems 


DVD writing: 


DVD+R, DVD-R, still images, audio clips, MPEG2 video and PCM 
audio real-time recording 
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TSCM Video Remote Probe Inspection Model 7514-2 

MEASUREMENT 

Supported Measurement Features 



1 Feature 


ShadowProbe® 


StereoProbe® 


Comparison 1 


Length/Distance 


■ 


■ 


■ 


Depth ■ ■ 


Polnt-to-Une 


■ 


■ 


■ 


Non-perpendicular Length ■ ■ 


Area 


■ 


■ 


■ 


Multi-Segment Length 


■ 


■ 


■ 


Circle Gauge 


■ 




■ 


3x Zoom Windows 


■ 


■ 


■ 


5 Measurements per Image 


■ 


■ 


■ 



OPTICAL TIPS 



1 TipView(DOV) 


flip Co lor 


field of View [FOWJ* 


Depth of Field DDOF) 


3 J mm Optical ftp Part# 


6,1 mm Optical lip Part# 


9 A mm Optical Tip Port # f 


Standard Tips 


FORWARD 


NONE H 


80* 


6 -SO mm 10.24-3.1 5 in.) 


PXT480FG 






FORWARD 


NONE H 


50° 


50 mm [197 in.l-infinity 




XLG3T6150FF 




FORWARD 


WHITE O 


50* 


12-200 mm (0.47-7.87 in. 1 




XLG3T6150FG 




FORWARD 


BLACK * 


120 B 


5-120 mm (0.20-4.72 in.) 




XLG3T6112QFG 




FORWARD 


NONE H 


40* 


250 mm 19.84 in.l-infinity 






XLG3T8440FF** 


FORWARD 


YELLOW 


20* 


500 mm (19.68 inj-infinity 






XLG3T8420FF 


FORWARD 


GOLD 


80* 


25-500 mm 10.98-1 8.68 in. 1 






XLG3T8480FG 


FORWARD 


BLACK * 


120* 


5-200 mm (0.20-7.87 in.i 






KLG3T84120FN 


SIDE 


BROWN * 


80* 


4-80 mm 10.16-3.1 5 in.) 


PHT480SG 






SIDE 


BROWN # 


50* 


45 mm (1.77 in.)-infinity 




XLG3T6150SF 




SIDE 


GREEN * 


50* 


9-160 mm (0.35-6.30 in.) 




XLG3T6150SG 




SIDE 


BLUE 


120* 


4-100 mm (0.16-394 in J 




XLG3T61120SG 




SIDE 


RED * 


80“ 


1-20 mm 10.04-0.79 in.) 




XLG3T6180SN 




SIDE 


BROWN * 


40* 


250 mm 19.84 in.l-infinity 






XLG3T8 440SF** 


SIDE 


GREEN * 


80* 


25-500 mm 10.98-18.68 in. 1 






MLG3T8480SG 


SIDE 


BLUE 


120' 


4-200 mm (0.16-7.87 in.) 






XLG3T84120SN 


Shadow Probe 1 *’ Measurement Tips 


FORWARD 


WHITE 0 


50* 


12-30 mm (0.47-1.18 in.) 




XLG3TM6150FG 




SIDE 


BLUE 


50* 


7-24 mm (0.28-0.94 in. 1 




XLG3TM6150SG 




Ster eoProbe 1 ® Measurement Tips 


FORWARD 


BLACK • 


60760* 


4-80 mm 10.16-3.15 in.) 




XLG3TM616060FG 




FORWARD 


BLACK • 


50750* 


5-45 mm 10.20-1.77 in.) 


PHTM45050FG 






FORWARD 


BLACK * 


60760* 


4-50 mm 1 0.16-1.97 in.) 






XLG3TM846060FG 


SIDE 


BLUE 


50750* 


2-50 mm 10.08-1.97 in.) 




XLG3TM615050SG 




SIDE 


BLUE 


50750* 


4-45 mm (0.16-1.77 in J 


PHTM45050SG 






SIDE 


BLUE 


60760* 


4-50 mm 1 0.16-1.97 in.) 






XLG3TM846060SG 



*FOV is specified diagonally. 

**lndicates tips with maximum brightness. 
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Marking Kit - Covert Stickers Illuminator 



Model 7515 



A thin gauge ultra destruct acetate with similar tamper evident properties to the type C vinyl. 

This is a cleat material, suitable for covert application and has a permanent acrylic based 
adhesive for use on any smooth, non porous surface especially glass and most forms of 
plastic 

Invariably printed with UV (invisible) test or design which can be detected by using a UV light 
source 



SAMPLE LAYOUTS 




KSS 
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Optical Search Kit Model 7516 

The Optical Search Toolkit is the budget alternative accessory kit to enable a thorough and 
effective physical search. For use in validating information provided with other equipment, such 
as the NLJD, the Optical Search Toolkit is ideal for searching hard to reach and inaccessible 
areas. 




The kit includes a side viewing endoscope for searching 
inaccessible areas (for example, wall cavities, crawl spaces, 
ventilation ducts, behind dashboards) through a gap of 10mm 
(0.4 in) in diameter. A 10W halogen lamp on the tip of the 
endoscope provides bright illumination and enables inspections 
to be made over distances of up to 1 ,5m (5ft). Power for the 
endoscope is supplied from a secondary power socket in the 
fluorescent handlamp included in the kit. 

Search mirror equipment includes a long telescopic arm that 
extends to 1500mm (59in.) for inspecting inaccessible areas in 
buildings, and a short fixed length model which is ideal for room searches. Both can be fitted 
with the range of interchangeable mirrors supplied. 

The kit also contains a fluorescent handlamp to provide a wide area working light and two right 
angle flashlights with belt clips. 

A selection of miniature mirrors and light probes and illuminated magnifiers are included to 
assist in the internal inspection of hard to reach areas. Mirror sizes range from 4.5 to 64mm in 
diameter. 
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Optical Search Kit Model 7516 

SPECIFICATIONS 



Kit contents 


Inventory & Specifications 


Flash light 


Right angle 2 C-cell (2 per kit) 


Flandlamp 


Fluorescent, 12 W, socket for endoscope 


Endoscope 


lOw lamp, 9.65mm (0.38in) diameter, 350mm (13,8in), side 
viewing (90° to shaft) 


Mirror arm with flashlight 


500mm (19.7 in), 45° mirror angle, 2 D-cell 


Mirror arm 


Telescopic, 1500mm (59in) open, 390mm (15.3in) closed 


Mirror 


140mm (5.5in) diameter, glass, convex, 127g (4.48oz) (3 per kit) 


Mirror 


64mm (2.5in) diameter, glass, piano, 32g (1.1 2oz) (2 per Kit) 


Mirror 


64x1 14mm (2. 5x4. 5 in), glass, piano, 68g (2.4oz) (1 per kit) 


Battery Handle 


2C-cell (2 per kit) 




The following light probe fit 


the battery handle 


Lamp holder 


Converts battery handle to torch 


Magnifier 


x8 with lamp 


Light probe 


2mm 0.08in) diameter, 150mm (5.9 in) length 


Mirror sleeve 


4.5mm (0.1 8in) diameter, mirror, fits light probe LP2/150 


Light probe 


3mm (0. 1 2in) diameter, 50mm (1 ,97in) length 


Mirror sleeve 


9.5mm (0.37in) diameter, mirror, fits light probe LP3/50 


Light probe 


3mm (0. 1 2in) diameter, 200mm (7.9in) length 


Mirror sleeve 


9.5mm (0.37in) diameter, mirror, fits light probe LP3/200 


Light probe 


8mm (0.3in) diameter, 254mm (1 Oin) length, right angled, rigid 


Light probe 


14mm (0.55in) diameter, 380mm (14.96in) length, straight, rigid 


Light probe 


14mm (0.55in) diameter, 380mm (14.96in) length, flex and stay 


Light probe 


14mm (0.55in) diameter, 380mm (14.96in) length, safety, acrylic 




Clip-on mirrors and accessories to fit 14mm diameter light probes 


Extension 


380mm (14.96in) length, straight 


Extension 


380mm (14.96in) length, angled 


Mirror 


64mm (2.5in) diameter, adjustable ball & socket joint 


Mirror 


380mm (1 ,5in) diameter, adjustable ball & socket joint 


Recovery magnet 
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Video & Audio RF Detection System Model 7517-01 

SPECTRUM 

The RF Intermediate Field Component 

This is a portable system for radio frequency surveillance 
analysis. As an Intermediate Field Counter Measure it can 
monitor an area of several rooms at a time. It is easily 
programmable, with results stored for repeated and future 
appraisal, with a full A4 report printout of text and graphical 
display in line or bar. A novice user with a modest background 
in radio scanning can have the unit operational in 30 minutes to 
produce a fully documented predetermined scan. 

This is NOT to be confused with Near Field, one room at a 
time equipment 

This is rapid deployment spectrum analysis, with additional Spectrum Analyzer functions. It can 
readily identify clandestine transmissions including Spread Spectrum devices, and display video 
transmission, "picture in picture" display. 

SYSTEM COMPONENTS 

• Fully self-contained unit, battery/mains operation 

• Windows Software professionally designed for Electronic Counter Measures 

OPERATING FEATURES 

The Video Capture system allows the operator to establish the type of video transmission. The 
actual video image is displayed, picture in picture, on the Laptop screen, and can be stored, 
saved and replayed. 

Mains and Line monitoring for cable/telephone line. 

SOFTWARE FACILITIES INCLUDE: 

• Automatically saves each scan; once every scan, or once every hour, for an unattended 
operation 

• Routinely compares files for additions and omissions 

• Possible Threat mode for continuous unattended operation, with alarm 

• Manual tune mode 

• Spectrum analyzer mode 

SPECIFICATIONS 

• Frequency Range 1 0 KHz to 3.0GHz 

• Internal rechargeable battery 

• High Speed Scanning 

• Video interpretation and display 

• Mains and line/cable monitoring 

• A4 print out 

• "Possible Threat" warning features 

• Auto save for unattended RF spectrum time profiling 
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Advanced Video & Audio RF Detection System Model 7517-02 

SPECTRUM 




The Advanced RF Far Field Component 



This is a portable system for radio frequency surveillance analysis. As a Far Field Counter 
Measure it can monitor a large area of many rooms or can target one at a time. It is easily 
programmable, with results stored for repeated and future appraisal, with a full A4 report 
printout of text and graphical display in line or bar. A novice user with a modest background in 
radio scanning can have the unit operational in 30 minutes to produce a fully documented 
predetermined scan. 

This is NOT to be confused with Near Field, one room at a time equipment. 

This is a professional, highly disciplined spectrum analysis, with additional Spectrum Analyzer 
functions. It can readily identify clandestine transmissions including Spread Spectrum devices, 
and display video transmissions. 

SYSTEM COMPONENTS 

• The Model 751 7-02 Super Wide Band Active Antenna 

• The Model 7517-02 receiver unit, now with extended frequency range to 6 GHz, and 
includes antenna switching and video analysis 

• ECM Windows software professionally designed for Electronic Counter Measures 

• HF super compact antenna 

• VLF Mains/telephone line/cable interface 

• Rugged transport case 

OPERATING FEATURES 

The Video Capture system allows the operator to establish the type of video transmission, AM, 
FM or inverted FM with switchable de-emphasis. The actual video image is displayed on the 
laptop, "picture in picture", and can be stored and replayed. 

Mains monitoring, software controlled, allowing L-N, L-E, N-E and auxiliary earth 
monitoring. 

Line monitoring for cable/telephone line. 
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Advanced Video & Audio RF Detection System Model 7517-02 

SOFTWARE FACILITIES INCLUDE: 

• Full remote control of antenna switching, video interpretation and display 

• Task scheduler for automatic sequence and save of scans. This is ideal for an 
unattended monitoring exercise 

• In built data base for display of frequency band allocation 

• Routinely compares files for additions and omissions 

• Possible Threat Mode for continuous unattended operation, with alarm 

• Manual tune Mode 

• Spectrum Analyzer Mode 

SPECIFICATIONS 

• Frequency Range 10 KHz to 6 GFIz 

• High Speed Scanning 

• Video interpretation and "picture in picture" display 

• Advanced mains and line/cable monitoring 

• A4 print out 

• "Possible Threat" warning features 

• Option for remote control 

• Vehicle installation option with covert antennas 

FURTHER SYSTEM DETAILS 

There are three primary components: The Receiver, the Antenna, and the Software. The 

system is housed in a single, very rugged, transport case. 

THE RECEIVER 

This is an upgrade from the previous system, and can be seen, bottom left, of the picture 
overleaf. It has an extended frequency range to 6 GHz. In addition, video is displayed on the 
Laptop screen, and can be saved and replayed at a later date. There is the option of a second 
video monitor if required. 

THE ANTENNA 

This is the Model 7517-02, an active version of our long standing Model 7517-01, and has an 
extremely wide frequency response, equating to a dipole from 25 MHz to 9 GHz. 

It has a beam width of 120 degrees, front and back, circularly polarized. 
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Advanced Video & Audio RF Detection System Model 7517-02 

THE SOFTWARE 

The software is subject to ongoing development and now includes a Database to identify and 
display the type of transmission intercepted. Personalized notes can be added to the data. 

A Task Scheduler is provided to help group personally configured scans to be automatically run 
and saved. 



Audio can be saved to the Laptop in the form of a "wav" file. 
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Omni Spectral Correlator 



Model 7518 OSC 



HIGH-SENSITIVITY SPECTRUM ANALYZER 



1 . Phased Locked Super Heterodyne Spectrum Analyzer 

2. Frequency Range: lOkhz To 3ghz (lOkhz To 21ghz With Optional Microwave Down 
Converter) 

3. Automatically Selected Antenna Inputs 

4. Sweeping If Bandwidths: 250khz, 15khz, And 6khz 

5. Frequency Spans Can Be Programmed With Single Button Control For Rapid Recall And 
Automatic Searching 




T he OSCOR provides user-friendly 
controls ond a high-quality digital 
graphic display. 

The OSCOR is one of the few 
Spectrum Analyzers designed 
specifically for cauntersurvei! lance, 



BUILT-IN SUITE OF DEMODULATORS 
AUDIO DEMODULATORS 

1. FM wideband 

2. FM narrowband 

3. AM wideband 

4. AM narrowband 

5. Sub-carrier 

6. Single Sideband 

7. 

VIDEO FORMATS 

1 . NTSC, PAL, SECAM 

2. AM or FM demodulation 

3. + or - synchronization pulse 

4. 

IF BANDWIDTHS 

1. Audio: 250kHz, 15kHz, and 6kHz 

2. Video: 10MHz 




Built-in suite of demodulators and 
audio oscilloscope view of signals. 








Monitor displays video signals for 
protection against covert video 
transmitters. 



PATENTED THREAT LOCATING SYSTEM 

The Patented Threat Locating System uses sonic ranging and triangulation to locate the 
transmitter microphone. 

This patented system can only be used if an audio signal can be demodulated with the OSCOR. 
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Omni Spectral Correlator 



Model 7518 OSC 




To locate a digitally demodulated 
Transmitter, the OSCOR RF locator 
probe is utilized. 



BUILT-IN ANTENNA ARRAY 

1. ACTIVE WHIP ANTENNA: 0.5-1 505M Hz frequency coverage. 

2. DISCONE ANTENNA: 1 500-3000M Hz frequency coverage. 

3. LOOP ANTENNA: 1 0-500kHz frequency coverage. 



4. INFRARED DETECTOR: 360°; wavelengths of 850-1 070nm and modulation from 10kHz- 

5MHz. 

5. STATUS INDICATORS: Display the selected antenna. 



AUTOMATIC SEARCHING, SIGNAL DETECTION, SPECTRUM TRACE 
ACQUISITION, AND STORAGE 

1. "LOAD FRIENDLY" mode stores outside ambient signals and traces prior to performing a 
sweep. 

2. TARGET SWEEP AREA SIGNALS are easily differentiated from ambient environment 
"Friendly Signals" and "Friendly Trace." 

3. ALL SIGNALS are dated, classified, and stored for later retrieval and automatic tuning. 

4. SIGNAL AND TRACE DATABASES can be stored for later comparison and analysis to 
determine if any new signals have been introduced into the environment. 



6. ACVLF: 



(not shown in picture) The AC power cord serves as a probe for 



testing for carrier current type transmitters. 
7. BUILT-IN 20dB PRE-AMP: Improves receiver sensitivity. 




Patented fold-out antenna panel 
automatically selects the proper 
antenna. Pre-amp provides maximum 
sensitivity for the proper input. 

No unreliable cable connections or 
mismatched antenna inputs. 
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Omni Spectral Correlator 



Model 7518 OSC 



The QSC0R provides an automatic 
5olu?ion to napndfy logging cmd 
classifying tne signals of ^our 
environment. 

Quick Reference Guide provides a 
single chart that completely defines 
the orog ramming process. 




TRACE ANALYSIS FOR RAPID DETECTION OF SOPHISTICATED TRANSMITTERS 

1. OPTIMIZED SWEEP TIME FOR FAST ANALYSIS: less than 5 seconds to complete one 
1 ,5GHz pass. 

2. FRIENDLY SPECTRUM TRACE provides reference trace for comparisons against sweep 
location trace. 

3. PEAK TRACE MINUS FRIENDLY TRACE quickly shows evidence of analog and digital 
transmitters including frequency hopping and burst/packet transmitters. 

4. TRACES CAN BE COMPARED for RF mapping of transmission sources within a building. 

5. DETAILED TRACE DATA IS STORED using 120,000 data points across the Whip High, 
Discone, and MDC antennas. 



Emanced race Analysis provides abilriy to compare targe: sweep area traces 
ta friendly traces, to quicldy identify evidence of transmitters in the target sweep 
□*ea (including freauency hopping and burst/packet transmitters). Trace ana 
signal datD can oe rurtner analyzed or stared on o computer mo USB interface 
for future comparisons o r RF mapping. 




AUTOMATIC THREAT CLASSIFICATION 

1 . AUTOMATICALLY ANALYZES SIGNALS using a patented sound pattern correlator. 

2. CORRELATOR PROCESS is integrated over time to ensure accurate correlation. 

3. SIGNAL THREAT LEVEL ESTABLISHED ON A SCALE FROM 1 TO 5 is based on the 



integrated correlation value. 

4. DIGITAL SIGNALS or signals that cannot be demodulated or correlated are flagged based on 
RSSI increase from Friendly reference. 
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Omni Spectral Correlator 




Model 7518 OSC 

For signals that are readily 
demDdu!atsa, the OSC OS easily 
classifies tnneatemng signals. Signals 
that are net readily demodLlaied are 
flagged for manual inspection. 

The patented OSCOR correlator 
provides- signal classification by 
correlating the aemodulc'ed audic 
of a received signal to the ambient 
enviro n ment. 



BUILT-IN PRINTER FOR RAPID HARDCOPIES 

Printouts can be generated of: 

1 . Frequency Spectrum 

2. Oscilloscope View 

3. Correlation Results 

4. Signal Database Listings 

5. Frequency Span Listings 

6. Threat Location Information 

7. System Configuration 



The OSCOR's built-in thermal printer provides a user-friendly "What You See is What You Get" 
method of generating printouts of important sweep data. 





I he built in printer allows you to 
moke quick printouts of suspicious 
5kg no Is, or complete spectrum faces. 



PC INTERFACE AND REMOTE CONTROL OF THE OSCOR 

The OSCOR PC interface software provides enhanced analysis capabilities as well as the ability 
to create permanent signal databases and trace profiles of sweep environments for RF mapping 
and future comparisons. The software also provides professional report and graph capabilities. 
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Omni Spectral Correlator Model 7518 OSC 

Software ADVANTAGES: 

1 . STORE, UPLOAD, AND DOWNLOAD signal and trace info. 

2. PROGRAM THE OSCOR for automatic operation. 

3. IMPROVED CONFIGURABLE USER 
INTERFACE. 

4. SIGNAL CLASSIFICATION using 
international frequency allocations. 

5. CUSTOMIZABLE REPORTS and frequency 
spectrum graphs. 

6. COMPARE AND ANALYZE historical 
signal and trace data to easily identify new 
signals detected in the sweep 
environment. 

7. HIGH RESOLUTION FULL-COLOR 
GRAPHICAL DISPLAY. 

Software BENEFITS: 

1. REMOTE CONTROL OF OSCOR from PC 
computer. 

2. RAPID THREAT INDICATION using 
detailed comparison of stored RF 
spectrum traces. 

3. QUICKLY IDENTIFY SOPHISTICATED TRANSMITTERS (frequency hopping & burst/packet) 
using peak difference traces analysis. 




OSCOR ADVANTAGES 

• Digital Spectrum Analyzer: Designed Specifically For Counter surveillance 

• Automatically Switched Antenna Array: With Built-In Pre-Amps 

• Automatic Programmability: Continuously Scans, Stores Signals And Traces, And Detects 
Threat Signals 

• Enhanced Trace Analysis: Detects Sophisticated Devices Such As Frequency Hopping 
And Burst/Packet Transmitters 

• Signal Database: Provides Storage And Recall Of Detected Signals And Spectrum Traces 

• Opc Software: Remote Control Capability And Ability To Store Signal And Trace Profiles 
For Future Comparison And Rf Mapping 

• Audio Analysis Mode: Provides Suite Of Demodulators 

• Video Demodulator And Monitor: Provides Viewing Of Covert Video Transmitters 

• Acoustic Correlator: Classifies Threatening Signals 

• Built-In Printer: Provides Hardcopy Of Signal Analysis Information 

• Multiple Threat Locating Systems: Patented Sonar Threat Locating System And Rf Locator 
Probe 

• Complete Package Of Sweep Equipment: Folds Into A Durable Attache-Style Case 
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Omni Spectral Correlator 



Model 7518 OSC 




PATENTED AUTOMATICALLY 
SWITCHED ANTENNA ARRAY: 
SF (1 0KHZ-3GHZ1 & INFRARED 



ANTENNA PRE-AMPS FOR 
IMPROVED SENSITIVITY 



MULTI-FORMAT VIDEO DISPLAY 



CARRIER CURRENT PROBE 
UTILIZING AC POWERLINE 



AUTOMATIC SPECTRUM TRACE 
CAPTURE, SIGNAL LOGGING 
AND CLASSIFICATION 



PROGRAM KEY FOR FIRMWARE 
UPGRADES 



BUILT-IN DEMODULATORS AND 
SELECTABLE IF BANDWIDTHS 



INTERNAL RECHARGEABLE 
BATTERY 



RF LOCATOR PROBE FOR 
LOCATING TRANSMITTERS 



PATENTED SONAR THREAT 
LOCATING SYSTEM 



USB PC INTERFACE, PC 
SOFTWARE INCLUDED 



BUILT-IN PRINTER 



INTERNAL HIGH-SENSITIVITY 
SPECTRUM ANALYZER 



CORRELATOR REFERENCE 
MICROPHONE FOR AUTOMATIC 
THREAT CLASSIFICATION 



USER-FR : ENDLY CONTROLS 



COMPACT CARRYING CASE 



ONE-YEAR WARRANTY 



The OSCOR is the only available security product that provides all of the above features in a 
single portable package. 



TECHNICAL SPECS 

RF SYSTEM 

Receiver: 

Frequency Coverage: 
Tuning Resolution: 
Sensitivity: 
Demodulators: 

IF Bandwidths: 
Attenuators: 

Dynamic Range: 
Subcarrier Tuning Range: 
Antenna Types: 

Balanced Loop: 

Active Whip: 

Discone: 

Infrared Detector: 

AC Carrier Current: 



Quad Conversion Super Fleterodyne phase locked Spectrum 
Analyzer 

10kHz-3GHz 

100Hz 

0.8p V typical with 15kHz bandwidth (+15dBm Max) 

AM, FM Wide, FM Narrow, FM SC, SSB/CW 
250kHz, 15kHz, 6kHz 

0, -20dB at Active Whip, Discone, and VLF-MF input 
90dB 

1 5-250kHz 

10-500kHz 

500kHz-1 500MHz 

1500-3000MHZ 

10kHz-5MHz, 850-1 070nm 

10kHz-5MHz (balanced across power line) 
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Omni Spectral Correlator 



Model 7518 OSC 



AUDIO SYSTEM 

Frequency Response: 

Voiceband Filter: 

AGC Dynamic Range: 
Output Power: 
Pleadphone Output: 
Remote Contact: 
Balanced Auxiliary Input: 
Reference Audio Input: 
Sonic Correlator: 

Audio Alarm: 

Squelch: 

Pleadphones: 



50Hz-1 5kHz 

300-3000Plz; 18dB/octave roll off 
60dB 
3W at 4 
0-2 V rms 

Normally open (200mA/32V max) 

0.5V rms nominal @ 600 

1 mV-1 V rms @ 3.9k 

50Hz-15kHz (frequency independent) 

3-level programmable 2-tone ringer 

Automatic digital or manual control over full display range 

Low acoustic leakage, 16 output limited to 105dBA 



VIDEO SYSTEM 

IF Bandwidth: 10MHz 

Independent Control of Formats 

Protocols: NTSC, PAL, SECAM 

Demodulators: AM or FM 

Synchronization Pulse: + or- 



SYSTEM INTERFACE 

Backlit Display: 128 x 256 Segment Graphics Supertwist 

LCD 




Built-in Printer: 192 dpi graphics on 2-inch-wide thermal 

paper 

Rotary Tuning Dial: 128 Pulse/Rev with variable count ratio 

USB Interface to PC 

Removable Program Key for firmware updates 



POWER SYSTEM 

AC Input: 

External DC Input: 
Internal Battery: 



1 05-1 30VAC/21 0-260VAC, 50-60Hz, 24W 
12-18VDC, 1 A max 

12V, 2.9Ah 3-hour operation per charge typical 



MECHANICAL 

Size (HxWxD): 6.25 in x 1 8.5 in x 1 4.5 in (1 5.9 cm x 47 cm x 36.8 cm) 

Weight: 29 lbs (13.2 kg) 
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Omni Spectral Correlator 7518 Option 

The Microwave Down-converter products provide increased frequency coverage for 
detecting illegal surveillance devices with the OSCOR. 

• MDC-900 Frequency Range: 3-9GFIz (Band 1 Only) 

• MDC-21 00 Frequency Range: 3-21 GHz (Band 1 , 2, & 3) 



TECHNICAL ADVANCEMENTS 

• Direct frequency control and band selection with OSCOR 

• Integrated High Gain Log Periodic Antennas 

• Tripod provides stability for MDC antennas 



TECHNICAL SPECIFICATIONS 

MODES & FREQUENCY RANGES: 

Frequency Range: 3-21 GHz 

Conversion output Frequency: 5-3005MHz 

MODES OF OPERATION: 

Band 1 : 3-9GHz 

Band 2: 9-15GHz 

Band 3: 15-21 GHz 

All Bands: 3-21 GHz 

ANTENNA GAIN: 

Band 1 : 6.1dB 

Band 2: 5.3dB 

Band 3: 8.4dB 




MDS (MINIMUM DETECTABLE SIGNAL) 

(Includes sensitivity, antenna gain, and filtering losses) 

Band 1 : -122.1dBm 

Band 2: -122.3dBm 

Band 3: -124.4dBm 



MECHANICAL: 


Input Power: 


200 milliamps at 1 2 V 


Weight: 


1.1 lb (.5 kg) 


Dim: 


11.4 in x 3.1 in x 1.4 in 




(29 cm x 8 cm x 3.5 cm) 



TRIPOD: 

Weight: .77 lb (.35 kg) 

Dim: 8.75 in x 2.5 in x 1 .5 in 

(22.2 cm x 6.4 cm x 3.8 cm) 
Usage Height: 5.5 in (14 cm) 




The MDC shown in 
operation with the 



OSCOR. 
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High Power GSM Jamming System Model 3521 

MODEL 3521 - PORTABLE HIGH-POWER-JAMMER - 25 WATTS 

The Model 3521 is an RF Jammer designed to paralyze the 2 way full duplex RF links between 
mobile phones and the local cellular cells. 

GSM 900/1800 MHZ 

FREQUENCY RANGE: 

900 -970 MHz: Channel 1 

1820-1920 MHz: Channel 2 
Optional Version: CDMA 

INPUT-POWER: 

RF Output Power: 25 Watts 

Omni directional Antenna 
Optional Version: 1 20 Watts 

MODULATION: 

Duplex Sweep 

(Special Digital-Modulation) 

POWER SUPPLY: 

90-240 VAC 

50-80 Hz/3 A 
Extern DC: 24 v - (use from car battery) 

MAXIMUM CONTROL PANEL (JAMMER DISTANCE): 

Can reach long distance of more than a KM depending on the type of antennas and topography 
of the areas 

DIMENSIONS: 49 x 36 x 18 cm 

WEIGHT: 30 Kg 
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Room Jammer 



Model 3522 



MODEL 3522 TECHNICAL MANUAL 

The Model 3522 Jammer is based on our long standing technological leadership and its proven 
jamming technology. We have widely used product base attests to our determination to provide 
high end, quality products to customers around the world. 



SPECIFICATIONS 

FREQUENCY RANGE 

GSM double Band 

890-1920 MHz 

OUTPUT-POWER 

890-970 MHz: 1 ,5W 

1820-1920 MHz: 1.5W 

MODULATION 

Special-Digital Sweep 

INPUT DC: 

24-26V automatic/1 .3A 

(DC-Box 95-240VCA) 

MAXIMUM CONTROL PANEL (JAMMER DISTA 

900Mhz: 14-20m 

1800MHz 1 2-20m 

(max. 400 sq m in rooms) 

2 ANTENNAS/SMA CONNECTOR 

DIMENSIONS: 1 10 x 170 x 64 mm 




WEIGHT: 550 g 
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Computer Screening Jammer Model 3525 

COMPUTER SECURITY EQUIPMENT - DATA DEFENDER 
GENERAL DESCRIPTION 




The compromising electro-magnetic radiation, which is emitted when working with computers, 
makes it possible for unauthorized reproduction of the monitor picture and the siphoning off of 




data. 

There are various possibilities available to protect against from an unauthorized attack on the 
compromising electro-magnetic emissions: 



1. Tempest Computer 

In this case a modified computer emits no compromising radiation. Because so few are 
manufactured, these devices are very expensive. Also, their compatibility with other 
systems is often restricted. 

2 . Shielded Rooms 

This form of protection has the advantage that standard PC systems can be used. The 
disadvantage of this form of protection is its high cost. In addition flexible use of the 
computer is not possible. 
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Computer Screening Jammer Model 3525 

3. Protection Device 

A protection device works by superimposing jamming signals and is suitable for any PC that 
is connected to a monitor via an external line. The computer can be used "bug proofed" in 
any position. 

PROTECTION DEVICE DEFENDER 

In contrast to other versions of protection devices that generate broad band noise that is 
superimposed on the video signal, the Defender detects only the computer system's pixel 
frequency information, and sends out a narrow band noise on this frequency. The pixel 
frequency depends on the computer system being used and is between 20 and 80 MHz and 
has the highest amplitude in this range. 



A microprocessor controlled spectrum analyzer searches for the pixel frequency. The pixel 
frequency you are interested in is scanned and the voltages of the single frequencies are 
assessed and saved. Furthermore, the frequency of the horizontal synchronization line is 
obtained and the possible pixel frequencies are calculated. 



A noise generator is clocked at the output of the protection device at the determined frequency. 
This type of noise generator is a narrow band and can always be switched automatically to the 
last found frequency. 

USE OF THE PROTECTION DEVICE DEFENDER 

The Defender is suitable for any computer that is connected to a monitor via an external line. 

The connection of the Defender is effected by the installation of the VGA cable from the graphic 
card to the monitor via the protection device. 

TECHNICAL DATA 
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Anti-Laser Microphone Noise Jammer Model 3526 

AUDIO JAMMING NOISEBATH SYSTEM 

The security of the patented NOISEBATH system is based upon the following six principles: 

• Maximizing complexity and coverage by ambient mixing of target's voice with masking 
sounds 

• Reducing the effectiveness of acoustic pick-up devices 

• Making computer filtering difficult by the design of the masking source 
material 

• Hindering listening by human transcribers with psycho-acoustic elements 
which create fatigue 

• Reducing the value of any information recovered with meaningless 
sequences of words in the masking material 

• Reducing the credibility of any derived information with deliberately deceptive masking 
material 




Playing NOISEBATH masking source material through the speakers of a 
properly configured system creates a "bath" of noise around the target, 
which mixes with the actual voices or equipment sounds. This hinders 
the exploitation of the target's acoustics. 

NOISEBATH is compatible with the STU III and other Secure Telephones. 

The masking sounds have negligible impact on the remote secure phone 
user. The masking level can be adjusted by remote control. 

There is up to a 25db reduction in sound level within the protection zone 
outside the protection zone. 

ACOUSTIC MASKING MATERIAL 

The acoustic masking source material is produced according to a specialized NOISEBATH 
formula and can be recorded on compact discs or generated in real time. Masking source 
material is a combination of varying pink noise, synthetic speech, actual speech and psycho- 
acoustic elements configured to minimize disruption to those being protected and maximize 
disruption to electronic audio surveillance systems and human listeners. 

Masking can also consist of specialized equipment sounds to mask 
intelligence bearing acoustics such as from computer keyboards. 

Masking source material is available in different languages, regional 
accents, dialects, or even for a particular person or persons. 

Mixtures of voice types are also available. 

Regional Editions are produced from actual voices and synthetic 
vocal sounds within a language or dialect selected by the customer 
such as American English Military Operations, Regional American Dialects Political & Legislative 
Subjects, Regional German Dialects, South American Spanish, Gulf Arabic, and Specialized 
Vocabularies of Various Intelligence and Law Enforcement Operations. 
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Advanced Counter Surveillance Jammer 



Model 3527 



MODEL 3527 TECHNICAL MANUAL 

The Model 3527 Jammer is based on our long standing technological leadership and its proven 
jamming technology. We have widely installed product base attests to our determination to 
provide high-end, quality products to customers around the world. 

The Model 3527 will protect room conversation against wireless bugs by Jamming the 
frequency modulation of the bugs. 

SPECIFICATIONS 

FREQUENCY RANGE: 

5 channels 

HF 20-80MHz 
VHF 80 -200MHz 
UHF 200 -500MHz 
SHF 500- 1000MHz 
SHFII 1800- 2000MHz 

POWER-OUTPUT: 

45-50 W sum of all channels 

MODULATION: 

Double-Digital-Sweep 

POWER-SUPPLY: 

220-240 V 

5 ANTENNAS: 

50 ohm N-Connector 

JAMMING DISTANCE: 

200 m 

DIMENSIONS: 460 x 520 x 280 mm 
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FSH Portable Spectrum Analyzer Model 7519 

DESCRIPTION 

The FSH Series (2, 3 or 6 GHz) spectrum analyzers are compact, battery-powered tools that 
provide RF measurement for TSCM based signal analysis/monitoring. In addition, the FSH3 
spectrum analyzer includes a color display that reduces errors by enhancing the visibility of 
critical signal details. The powerful software package with signal comparison evaluation provides 
excellent functionality and compares previously scanned measurement. 



APPLICATIONS 

• TSCM Nearfield Analysis 

• Cable installation and maintenance 

• Verifies production line equipment 

• General field use for communications 
installation and maintenance 

• Field wireless equipment installation and 
maintenance. Outdoor antenna 
characteristics measurements. 



FEATURES & BENEFITS 

• Portable handheld spectrum analyzer; Small 
and light enough to be perfect for handheld 
applications 

• Superior RF Characteristics - fast, accurate, 
precision instrument for its price 

• Color display enhances usability and visibility; 

100 kHz to 3 GHz frequency range; covers all major communication standard 
transmission frequencies 

• RMS detector for correct digital signal analysis 

• Over 4-hour battery life; extremely portable for field use 

• Built-in preamplifier; improve sensitivity by 15 dB; improved instrument sensitivity to 
detect more low level signals 

• Selectable output power for the tracking generator; 0 dBm; test devices with higher 
power ratings without additional external equipment; additional narrower resolution 
bandwidths down to 100 Hz; improved performance measuring narrow bandwidth 
signals 
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FSH Portable Spectrum Analyzer Model 7519 





FSH 3 


FSH 6 


Frequency Range 


100KHzto3 GHz 


1 0OKHz to 6 GHz 


Resolution Bandwidth 


1KHz(100 Hz) to 1MHz 


10Hz to 1 GHz 


Video Bandwidth 


10 Hz to 1 MHz 


10 Hz to 1 MHz 


Displayed Avg. Noise Level 


Typ. -1 16 (-125*) dBm (1 kHz) - 


135 dBm 


T.O.I. 


15 dBm typ. 


15 dBm typ. 


SSB Phase Noise 


<-100dBc (Hz) at 100 kHz carrier 
offset 


<-100dBc (Hz) at 100 kHz 
carrier offset 


Detectors 


Sample, peak, auto peak, RMS 


Sample, peak, auto peak, RMS 


Total Measurement 
Uncertainty 


1.5 dB 


1.5 dB 


Reference Level 


-80dBm to +20 dBm 


-80dBm to +20 dBm 


Dimensions W x H x D 
(mm) 


170x120x270 


170x120x270 


Weight 


2.5 kg 


2.5 kg 




2 
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Covert RF Bug Detector up to 6 GHz 



Model 7520 



DESCRIPTION 

This compact Bug Detector is the latest generation of high sensitive broadband Radiofrequency-Detectors 
and is the size of a cigarette packet. It detects active miniaturized transmitters within a distance of some 
meters and is excellent to use as an additional instrument when looking for bugging devices. 

The sensitivity of the Bug Detector is adjustable to allow the precise allocation of active transmitters 
nearby. The signaling can either be acoustic or visual with an LED bargraph. With a discrete vibration 
alarm this device can also be body-worn. By using the Bug Detector's earphone, signals of common 
modulations can be demodulated. The rechargeable battery guarantees long operating time. 

FEATURES 

ADVANTAGES: 

The Bug Detector is highly miniaturized and discrete 

It's more sensitive than most large near-field receivers (so called. „Bug Finders") 

The frequency range covers all common RF-standards, like GSM, UMTS, DECT, Bluetooth 
& WLAN 

Detects active sound, video & data transmissions 
The vibration alarm allows hidden body-worn use 
Excellent cost/performance ratio 

Important notice: An RF-Receiver cannot replace a physical 
search! 

INCLUDED: 

• Receiver with changeable broadband antenna 

• Earphone & mini-charger (AC adapter) 

• Shock protected transport case & user manual 

Change without notice! 

TECHNICAL DATA 



Frequency range: 


10 MHz to > 6 GHz 


Receiver sensitivity: 


-46 dBm at 10 MHz 
-58 dBm at 900 MHz 
-58 dBm at 2300 MHz 
-32 dBm at 5000 MHz 


Audio-output: 


1W/8Q 


Demodulation: 


AM, ASK, FSK, (FM) 


Power supply: 


AC adapter 1 00 - 240 V 
Charging at 4,2 V/650 mA 
Lithium Batt. 3,7 V/2000 mAh 


Current consumption: 


30/300 mA (without/with vibration) 


Battery life: 


> 10 hours 


Size: 


85 x 55 x 1 8 mm (Receiver) 


Antenna: 


70 mm broad-band antenna 


Weight: 


1 10 g (Receiver)/450 g (Set) 
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Miniport Receiver EB200 



• Ergonomic design for on-body 
operation 

• Continuous frequency range 
1 0 kHz to 3 GHz 

• Detection of unlicensed trans- 
mitters 



• Location of close-range to 
medium-range targets with the 
aid of Handheld Directional 
Antenna HE200 

• Digital IF section with 12 band- 
widths (1 50 Hz to 1 50 kHz) 

• Fast, accurate level indication 
across 110 dB dynamic range 



• Scanning modes 

- Frequency scanning 

- Memory scanning 

• Frequency spectrum (option) 

• IF panorama display (option) 

• Remote-controllable via 
RS232 CPPP or LAN (Ethernet 
1 OBase-T) 



Miniport Receiver EB200 with Active 
Directional Antenna HE200 is a porta- 
ble unit for radiomonitoring in the 
wide frequency range from 1 0 kHz to 
3 GHz. Whether used for monitoring 



In case of power supply interruption, 
all the data is stored. Operation can 
thus be resumed immediately after the 
power supply is restored. 



• Location of close-range to medium- 
range targets with the aid of Hand- 
held Directional Antenna HE200 

• Detection of undesired emissions 
including pulsed emissions 

• Detection of unlicensed transmitters 
communicating illegally or interfer- 
ing with licensed transmission 




emissions, detecting interference or 
locating mini-transmitters irrespective 
of their position, EB200 offers features 
unrivalled in its class. The favourably 
priced and compact receiver with LAN 
interface may also be used in compu- 
ter-based stationary systems. 

The EB200 is characterized by high 
input sensitivity and frequency setting 
accuracy throughout the frequency 
range from 1 0 kHz to 3 GHz. 

Its small dimensions and low weight as 
well as a sturdy, pickup-proof die-cast 
aluminium housing with well-protected 
integrated operating elements make 
the EB200 ideal for use in places 
which cannot be reached with a vehi- 
cle. Its low power consumption permits 
battery operation typically of four 
hours. The EB200 battery pack is eas- 
ily accessible and can be exchanged 
quickly. 



EB200 fulfils the following tasks: 

• Monitoring of given frequencies, 
eg storage of 1 to 1 000 frequen- 
cies, squelch setting, constant mon- 
itoring of one frequency or cyclical 
scanning of several frequencies 

• Searching in a frequency range 
with freely selectable start and stop 
frequency and step widths of 

1 kHz to 9.999 MHz 



• Protection against tapping by de- 
tecting miniature spy transmitters 
(bugs) 

• Monitoring of one's own radio ex- 
ercises in a service band 

• Monitoring of selected transmissions 

• Remote-controlled operation via 
modem and PC in coverage meas- 
urement and monitoring systems 




Miniport Receiver EB200 






Frequency range 

Frequency setting 
via keypad or rollkey 

Frequency accuracy 
Aging 

Synthesizer setting time 
Oscillator phase noise 

Antenna input 

Oscillator reradiation 
RF attenuation 
Input selection 

100 kHz to 20 MHz 
20 MHz to 1 .5 GHz 
1 .5 GHz to 3 GHz 

Interference rejection, nonlinearities 

Image frequency rejection 
IF rejection 

2nd order intercept point 
3rd order intercept point 
Internal spurious signals 

Sensitivity 

Overall noise figure 
(including AF section) 

20 MHz to 650 MHz 
650 MHz to 1500 MHz 
1 500 MHz to 2700 MHz 
2700 MHz to 3000 MHz 
Signal-to-noise ratio 

AM, bandwidth 6 kHz, 

Lod = 1 kHz > m = 0.5 

20 MHz to 2700 MHz, V = 1 pV 
2.7 GHz to 3 GHz, V= 1.3 pV 
FM, bandwidth 1 5 khlz, 
f mod = 1 kHz, deviation = 5 kHz 
20 MHz to 2700 MHz, V = 1 pV 
2.7 GHz to 3 GHz, V= 1.3 pV 

Demodulation 

IF bandwidths 

IF bandwidths for level and 
deviation indication 

Squelch 

Gain control 
IF control 
RF + IF control 
AFC 

Deviation indication 
Signal level indication 

IF panorama display (option SU) 

Scan characteristics 

Automatic memory scan 

Frequency scan 

Inputs/outputs 

Digital IF output 

Bidirectional reference frequency 
connectors 
in 
out 

l/Q output (digital) 

IF 10.7 MHz, wideband 



10 kHz to 3 GHz 

1 kHz, 1 00 Hz, 1 0 Hz, 1 Hz or in 
selectable increments 
<±1 .5x1 0 6 (-10°C to + 55 °C) 
<±0.5x1 OVyear 
<3 ms 

<-l 00 dBc/Hz at 1 0 kHz offset 

N socket, 50 Q , VSWR <3; SMA con- 
nector for rackmounting at rear panel 
<-107 dBm 

30 dB, man. or autom., switchable 

highpass/lowpass 
tracking preselection 
highpass/lowpass 

>70 dB, typ. 80 dB 
>70 dB, typ. 80 dB 
typ. 40 dBm 
typ. 2 dBm 
<-107 dBm 



<14 dB, typ. 1 2 dB 
<15.5 dB 

<14 dB, typ. 1 2 dB 
<15 dB, typ. 1 3 dB 
measurement with telephone filter to 
CCITT 



>1 0 dB 
>10 dB 



>25 dB 
>25 dB 

AM, FM, USB, LSB, CW 
12 (150/300/600 Hz/1 .5/ 2.4/6/ 
9/15/30/50/120/150 kHz) 

1 5 (1 50 Hz to 1 MHz) only with 
IF Panoramic Unit EB200SU 
signal-controlled, can be set from 
-1 0 dBpV to +1 00 dBpV 
AGC, MGC 
80 dB 
1 10 dB 

digital retuning for signals unstable in 
frequency 

graphical with tuning label 
graphical as level line or numerical 
from -1 0 dB(jV to + 1 00 dBpV, acoustic 
indication by level tone 
internal module, ranges 25, 50, 100, 
200, 500, 1000 kHz 



1 000 definable memory locations to 
each of which a complete data set can 
be allocated 

START/STOP/STEP definition with 
receiving data set 



serial data (clock, data, frame) 
up to 256 ksps: 2 x 1 6 bit 

10 MHz, BNC 

0.1 Vto 1 V; R; = 500 Q 

0 dBm, R 0 = 50 Q 

AF signal, 2 x 1 6 bit 

±5 MHz uncontrolled for external 

panoramic display 



AF output, balanced 
Loudspeaker output 
Headphones output 
Output log. signal level 

BITE 



Data interface 

Option 

General data 

Operating temperature range 
Rated temperature range 
Storage temperature range 
Humidity 
Shock 



Vibration (sinewave) 

Vibration (noise) 

Electromagnetic compatibility (EMC) 

Power supply 

Dimensions (W x H x D) 

Weight (without battery pack) 
Battery pack 



Frequency range 
Antenna modules 

20 MHz to 200 MHz 
200 MHz to 500 MHz 
500 MHz to 3000 MHz 
Option 

0.01 MHz to 20 MHz 
Polarization 



Loop antenna 
0.01 MHz to 20 MHz 



Nominal impedance 

SWR 

RF output 

Gain 

Antenna factor 
Field-strength sensitivity 
Linearity of amplifier 

Current drain 

Power supply 
Dimensions (W x H x D) 

General data 

Operating temperature range 
Rated temperature range 

Storage temperature range 
Vibration resistance 



Shock resistance 
Weights: 

Supply and display unit 
with adapters and compass 
RF modules 
20 MHz to 200 MHz 
200 MHz to 500 MHz 
500 MHz to 3000 MHz 
0.01 MHz to 20 MHz 



600 Q , 0 dBm 
8 Q , 500 mW 
via volume control 
0 V to +4.5 V 

monitoring of test signals by means of 
loop test 

RS232CPPP 

LAN (Ethernet lOBase-T) 



-1 0°C to +55°C 

0°C to +50 °C 

-40 °C to +70 °C 

max. 95%, cyclic test 25/55 °C 

to DIN IEC 68-2-27 

(MIL-STD-8 1 0D, MIL-T-28800D), 40 g, 

shock spectrum 45 Hz to 2 kHz 

to DIN IEC 68-2-6 (MIL-T-28800D), 

5 Hz to 55 Hz, 0. 1 5 mm amplitude 
to DIN IEC 68-2-36, 1 0 Hz to 500 Hz, 
1 .9 g (rms) 

EN5008 1/82-1, 82-2, MIL-STD-461, 
CE03; RE02 and RS03 
battery pack (typ. 6 h operation) or 
DC 10 Vto 30 V (max. 22 W) 

210 mm x 88 mm x 270 mm 
72 19" x2 HU 
4 kg 
1.5 kg 



0.01 MHz to 3000 MHz 

20 MHz to 3000 MHz, with 3 plug-in 

antennas 

loaded loop antenna 
loaded loop antenna 
log-periodic antenna 

loop antenna 

vertical for all antenna modules, hori- 
zontal polarization by turning the lon- 
gitudinal antenna axis by 90° 

direction finding for horizontally polar- 
ized signals not possible because of 
circular vertical pattern of system 
50 Q 
<2.5 typ. 

1 m cable with N connector 

for typical values see page 7 

for typical values see page 7 

for typical values see page 7 

IP3, typ. 1 9 dBm (battery voltage 6 V, 

25 °C) 

55 mA in active mode 
0 mA in passive mode 
in handle, 4 x 1 .5 V mignon cell R6 
470 mm x 360 mm x 1 80 mm 
(in transport case) 



-30°C to +60°C active/ passive mode 
-10°C to +50 °C active mode 
-30 °C to +60 °C passive mode 
-30°C to +60 °C 

random 1 0 Hz to 300 Hz: 0.0 1 g 2 /Hz, 
300 Hz to 500 Hz: 0.003 g 2 /Hz, 
every 30 minutes in 3 orthogonal 
axes; acceleration approx. 1 .9 g rms 
max. 40 g, crossover frequency 45 Hz 
in 3 orthogonal axes 

0.5 kg 
0.65 kg 

0.55 kg 
0.3 kg 
0.45 kg 
0.4 kg 
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Digital Scout Frequency Detector 



Model 7522 



DESCRIPTION 

The Model 7522 Digital Scout RF frequency detector/field strength meter is a near field 
measurement instrument that captures digital, as well as analog signals, from 10MHz -2.6GHz. 
Until now, the only signals that frequency counters could lock onto were analog signals. In 
addition to locking onto digital and analog signals, the Model 7522 has a calibrated signal 
strength measurement from -45dBm to -5dBm. 

USAGE 

One can use the Model 7522 in all places where unknown near field RF-signals must be 
captured, localized and examined regarding their frequencies. 

The Model 7522 is capable of detecting many different types of digital modulations that have a 
minimum pulse width of 500mS; signals such as TDMA, GSM, APCO 25, ON/OFF Keying, 
TETRA and more. 

The Model 7522 is not capable of counting signals such as Spread Spectrum, CDMA and PCS. 

FEATURES 

• 10MHz - 2. 6GHz frequency range 

• 5-6 hour battery operation 

• 2x1 6 alphanumeric LCD with EL backlight 

• Signal Strength reading displayed in dBm and barograph - 

• 45dBm to -5dBm 

• +/- 5dBm signal strength accuracy 

• Download memory to a PC using the optional Optolinx interface 

• Reaction Tune analog signals with ICOM 1C RIO, R7000, R7100, R8500 and R9000. AOR 
AR8000 and AR8200. Optoelectronics Optocom, OS456/Lite, OS535 and R11.BC245XLT 
and BC780 (SmartLink cable required) 

• 1000 memories with 65,000 hits per memory 

• Captures both Digital (Minimum 500mS RF pulse required) and analog signals 

• Beeper and Vibrator alert 

• Super Sensitive, down to 700uV in some bands 



TECHNICAL DATA 



Frequency Range: 


10MHz to 2.6GHz 


Resolution: 


1 KHz and 100Hz 


Frequency Accuracy: 


Ippm 


Signal Strength: 


-45dBm to -5dBm 


Signal Accuracy: 


+/- 5dBm 


Display: 


2x16 alphanumeric LCD 


with EL backlight 


Power: 


9 VDC, 150mA 


using model AC90 wall 


Plug adapter. 


Size (H x W x D): 


5.25" x 3" x 1.5" 


Weight: 


12 oz 
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Advanced Cable Tracing System 



Model 7523 



With cable measurement taking up to 30 percent of a sweep effort, tools that provide important 
information effectively and quickly are needed. The Advanced Cable Tracing System is 
designed to aid in locating all cables coming from the target location. Capable of tracing cables 
buried as deep as 2 meters, this system excels in ensuring all potentially dangerous cables are 
found. 
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X-Ray for Screening VIP Presents 



Model 7525 



A slim-line, large capacity color mail and parcel 
scanner 

You can't always predict what will arrive in the 
mail but you can protect yourself against nasty 
surprises. X-ray scanners see inside your mail and 
provide on the spot confirmation of unusual or 
unexpected packages. 

• Large inspection chamber accepts postal 
trays, parcels and briefcases. 

• Slim-line design 

• Quick and easy to use 

• Uses a simple mouse control 

• Latest color technology 

• Freestanding with front loading door 

• Scans VIP presents & suspected bugs 




REASSURANCE FOR YOUR STAFF 

The Model 7525 cabinet X-ray scanner provides on the spot verification 
of unusual packages giving reassurance to all staff handling mail. 



COMPACT AND EASY TO USE 

The Model 7525 is designed for easy use by non-technical staff. 
Combines a large inspection chamber with a slim-line cabinet allowing 
you to examine volume mail, large parcels and briefcases in areas 
where space is at a premium. 



RAPID SCREENING 

Items are placed in the front loading inspection chamber and a single 
button action produces a clear image of the contents in seconds. 




IMAGE ENHANCEMENT COLORSCAN MODEL 

• Automatic Image Enhancement 

• Negative or inverse image option 

• 8 x zoom 

• 2 color options for highlighting medium and high density 

• objects 



CONFIDENTIAL 



1 




elaman 



X-Ray for Screening VIP Presents 



Model 7525 



BASIC B/W MODEL (BLACK AND WHITE) 

• Simple black and white image 

HEALTH AND SAFETY 

The X-ray scanners use very low level X-rays and conform to all 
published international Electrical Safety and Radiation Standards and are 
issued with a certified Radiation Safety and Test report. 

X-RAY IMAGE RECOGNITION 

Basic Operator Training and X-ray image recognition charts can be 
provided. 



Full maintenance and back-up support is available. Due to the nature of 
its design the Model 7525 has no conveyor or electrical moving parts 
that might require expensive servicing. 




SERVICING AND SUPPORT 




TECHNICAL SPECIFICATIONS 



Inspection Chamber 



Width: 42.8 cm (17") 



Physical Specifications 



Height: 162.5 cm (65") 



Width: 



Height: 



Depth: 



53.5 cm (21") 
42 cm (17") 
56 cm (22") 



Depth: 61 cm (24") 



Door Opening: 



Net Weight: 170kg (330lbs) 



Width: 



Height: 



53.5 cm (21") 
34 cm (13.6") 



Image Area: 

Depth: 41 cm (16") 

Width: 34 cm (13.6") 



Power requirements 1 1 0V, 230V, 50/60 Hz 
Shipment specifications 1 1 2 (w) x 77 (d) x 1 50 (h) cm 



Weight: 250kgs 
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TopSec GSM 

The mobile phone for your confidential calls 

♦ High security level ♦ Invariably reliable speech quality ♦ Recommended by the German 

♦ Top-quality speech encoding for end-to- ♦ Simple handling Information Security Agency 

end voice communication 




ROHDE&SCHWARZ 




TopSec GSM: mobile and 
confidential 

The fast transfer of information and 
instant decisions, particularly at higher 
levels of management are more impor- 
tant than ever. Therefore, it must also be 
possible to exchange confidential infor- 
mation over mobile phones. In the GSM 
transmission mode, data is only encryp- 
ted between mobile phone and base sta- 
tion. Beyond that, the call is routed via 
radio relay or fixed networks without any 
protection. In some countries even the 
minimum security requirements for 
mobile communication are not met. 

The TopSec GSM has been developed so 
that confidential information can be 
exchanged reliably and without any risk 
of eavesdropping. 

The "top secret" mobile phone 
meets highest demands 

The basis of the TopSec GSM is the 
renowned Siemens dualband mobile 
phone S 35i. The core, however, is the 



crypto module. Due to its size of only 
32 mm x 34 mm it has been completely 
integrated into the S 35i. The TopSec GSM 
cannot be distinguished from a normal 
Siemens S 35i mobile phone. 

In addition to the encryption function, the 
TopSec GSM offers all advantages of a 
latest-generation mobile phone: 

♦ Excellent speech quality 

♦ Simple operation 

♦ Voice dialling 

♦ Compact size 

♦ Low weight 

♦ Internet access via WAP browser 

♦ Soft modem and 

♦ IR interface for mobile data transfer 

Encrypted speech is transmitted on the 
transparent GSM data channel. Through 
the use of the GSM half-rate vocoder, 
excellent speech quality is ensured even 
in the encrypted mode. To attain top 
security, two algorithms are combined; 
an asymmetrical algorithm with a 1 024-bit 
key for key agreement and a symmetrical 
algorithm with a 128-bit key for voice 
encryption. 



As is the case with the TopSec ISDN 
encryption devices for voice and data 
communication, the TopSec GSM is 
recommended by the German Informa- 
tion Security Agency, confirming the high 
security standard. 

Security in mobile radio net- 
works and on the ISDN landline 
network 

The TopSec GSM is suitable for encrypted 
end-to-end voice communication in the 
GSM frequency ranges of 900 MHz and 
1800 MHz. A confidential discussion can 
be carried on between two TopSec GSM 
mobile phones without any risk. 

Encrypted calls from the TopSec GSM can 
also be made to the landline network: 
the only prerequisite is that the called 
ISDN station must be protected by a 
TopSec 703+ of the TopSec product family. 




TopSec GSM 



Absolute confidentiality at a 
single keystroke 

Dial the number of the desired subscriber 
and briefly press the crypto softkey below 
the display to switch to the crypto mode. 



In the crypto mode, yourTopSec GSM phone 
and the called TopSec station automatically 
agree on a new 1 28-bit key for each call. The 
128-bit key is randomly determined out of 
10 38 possibilities and erased after the call 
is terminated. 



"Crypto" is indicated in the display to 
confirm the encryption mode as well as a 
4-digit control code (see figure). In the 
case of closed subscriber groups, auto- 
matic authentication is performed by a 
public key procedure. 

Thus you can be sure that your communi- 
cation is encrypted and that nobody can 
eavesdrop your call. 



Crypto 



►491704548378 
2057 ^0 



Hallen ■ ^Memi 



This method is one of the essential secu- 
rity features offered by TopSec GSM. 



Crypto mode 
indicated in the display 



Size of 

crypto module 




Specifications 



Frequency range 
GSM class 4 (2 W) 
GSM class 1 (1 W) 


880 MHz to 960 MHz 
1710 MHz to 1880 MHz 


Voice transmission 


normal operation, 


(GSM half-rate vocoder) 


encrypted transmission 


Operating voltage 


3.6 V 


Current drain 


max. 400 mA 


Operating temperature 


0°Cto 45°C 


Standby time 


up to 220 hours 


Talktime 


up to 6 hours 



Size 118 mm x 46 mm x 21 mm 



Weight 


105 g 


Ordering information 




TopSec GSM 


3531.6527 



TopSec GSM 
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Ultra Scan50b X-ray Unit Model 7530 

Ultra Scan50b is the subsequent upgrade of Ultra Scan50a. With over 3000 installations 
worldwide Ultra Scan50b is an extremely successful compact X-ray inspection system. 

A modular designed tabletop system; Ultra Scan50b is flexible, extendable and therefore can be 
used for different applications. 

Due to state-of-the-art X-ray-, sensor- and computer-technologies this system offers 
functionalities, which in the past were reserved solely for aviation security purposes. 

Ultra Scan50b permits configurations with 
operator training, TIP- and image management 
functionalities. 

Being one of the most space saving X-ray 
inspection systems available, Ultra Scan50b is 
ideal for use in mailrooms, entrance halls, 
correctional and judicial facilities, schools and 
many other security sensitive areas, where 
contact-free inspection of pouches, bags, 
letters or packages is required. 

Ultra Scan50b --increased security thanks to 
advanced technology. 

FEATURE HIGHLIGHTS 

• Compact desktop solution for mobile and stationary applications 

• New X-ray generator plus new sensor technology for high performance 

OPTIONAL 

• HI-TIP: Threat Image Projection 

• Xtrain: Operator training system 

• IMS: Electronic image storage and archive 

• Xport: Image export in TIF- or JPEG format incl. automatic transmission to PC via 
Ethernet 



TECHNICAL DATA HI-SCAN 5030SI 



General Specifications 




Tunnel dimensions 


532 (B) x 330 (H) [mm] , 21 " (B) x 13" (H) 


Max. object size 


530 (B) x 320 (H) [mm] , 20.9" (B) x 12.6" (H) 


Conveyor height 


approx. 190 mm (7.4") 


Conveyor speed at mains frequency 50 
Hz/60 Hz 


approx. 0.18 / 0.22 [m/s] 


Max. conveyor load (evenly distributed) 


60 kg (132 lbs) 


Resolution (wire detectability) 


Standard: 38 AWG (0.13 mm) typical: 39 AWG (0.10 
mm) 


Penetration (steel) 


Standard: 10 mm, typical: 12 mm 


X-ray dose (typical) 


HI-MAT: 1.6 pSv (0.16 mrem) 


Film safety 


Guaranteed even for high speed films up to ISO 1600 
(33 DIN) 


Duty cycle 


100%, no warm-up procedure required 
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Ultra Scan50b X-ray Unit 



Model 7530 



X-ray Generator 




Anode voltage 


100 kV cp 


cooling 


hermetically sealed oil bath 


Beam direction 


diagonal 


Image Generating System 




X-ray converter 


L-shaped detector line, high resolution 


Grey levels stored 


4096 


Image presentation 


S/W, color 


Digital video memory 


1 280 x 1 024 / 24 bit 


Image evaluation functions 


B/W, HIGH, LOW, NEG; incl. Option HI-MAT, additionally 
VARI-MAT, 02, OS electronic zoom: stepless 

enlargement up to 16-times 


Monitor 


17" color monitor, low radiation according to MPR II und 
TCO 99 standards other monitors on request 


Additional Features 




Features 


Luggage counter, user-id number, display of operating 
mode, REVIEW-feature to recall previously visible image 
areas, zoom overview, free programmable keys 


Options 


HI-TIP, HI-SPOT, SEN, Xport, IMS (Image Management 
System) 


Installation Data 




X-ray leakage 


meets all applicable laws and regulations with respect to 
X-ray emitting devices 


CE-labeling 


in compliance with 98/37/EWG, 72/23/EWG, 

89/336/EWG 


Sound pressure level 


< 56 dB(A) 


Operating-/storage temperature 


0° - 40°C/-20°C - +60°C 


Flumidity 


1 0% - 90% (non-condensing) 


Power supply 


standard: 230 VAC or 1 1 0 VAC +10% / -1 5% 
50 Hz / 60 Hz ± 3 Hz 


Power consumption 


approx. 0,3 kVA 


Protection class system/keyboard 


IP 20 /IP 43 


Dimensions 


1 200 (L)2) x 705 (B) x 726 (H) [mm] 
47.3" (L)2) x 27.7" (B) x 28,6" (H) 


Weight 


approx. 160 kg, approx. 352 lbs 


Mechanical construction 


Steel construction with aluminum panels standard 
color(s): RAL 9006 (white aluminum)/stainless steel 
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3D image Enhancer 



Model 7539 



DESCRIPTION 



The 3D Image Enhancer is a brand-new system for upgrading mobile X-ray units, from 2D into 
3D visualizing of X-ray images. The stereoscopic view provides more information about the 
checked items to the user. Typical applications are EOD, NDT, TSCM and all others, where 
more security is necessary. 



The 3D Image Enhancer is set up very quickly and is easy to handle with an intuitive user 
interface, which needs no additional training. The software steers a linear motor to move the X- 
ray source automatically into the right shot positions to provide the required images. 



All common types of X-ray image media can be used, even conventional films and storage foils, 
if they need to be scanned later on. The digital 2D images, coming from a scanner or an image 
converter, can be individually enhanced and processed into a 3D visualization by the 3D Image 
Enhancer. In the 3D viewing mode zoom, detail, pan, tilt and rotation of the stereoscopic image 
is changeable by mouse control. 



FEATURES 

ADVANTAGES: 

• 3D viewing without red/green or polarized glasses 

• Lightweight & easy to use system for intuitive operation 

• Adaptable to numerous mobile X-ray units 

• All common X-ray images can be processed into 3D (e.g. scans from X-ray films & 
storage foils, images from analog & digital image converters) 

• Import function for JPG, TIF and EPS formats 

• Image enhancement, e.g. brightness, contrast, filters, sharpness, bump map, gamma corr. 
with preview in 2D 




Illustration 



3D Visualization 
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3D image Enhancer Model 7539 

INCLUDED IN DELIVERY: 

• 3D Image Enhancer Software for X-ray source motion control, image processing & 3D 
visualization (single license) 

• High end 3D Laptop with mouse 

• Linear motor for motion of X-ray source 

• Controller for linear motor 

• Power supply 1 00 - 240 V and rechargeable battery 

• Cable set 1 0 m (50 m option available) 

• Tripod for linear motor and X-ray source 

• Waterproof, shock protected transport case 

• Supplied without X-ray source & image converter! 

TECHNICAL DATA 



Processing time: 


About 1 0 - 30 s per 3D image 


Max image size: 


2000 x 2000 pixels 


Processor: 


Intel® Pentium ®4, 2.8 GHz 


Operating System: 


Windows® XP Professional 


RAM/HDD/Optical Drive: 


512 MB DDR SDRAM/60 G B/DVD-R/-R W/R AM (max 8x) 


Video Controller: 


NVIDIA® GeForce™ 4 440 Go 


VRAM: 


64 MB DDR video memory 


Monitor: 


LCD 15" 3D-XGA/ 1024x768 


I/O Ports: 


USB 2.0, PCMCIA II, 100 Base-TX, 56 kbps Modem, IEEE1394, SD- 
& CF-Card, Memory Stick™ 


Environment: 


1 0 to 35°C / 20 to 80% humidity 


Case size: 


62 x 50 x 22 cm 


Total weight: 


15 kg (including case) 
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Wireless Network Detector 



Model 7540 



DESCRIPTION 

The professional Wireless Network Detector and visualization tool detects and stores all the 
important information about your Wireless Network Environment automatically to an SQL 
Database and visualizes your WLAN infrastructure on your own imported maps. The information 
stored in the Database contains extensive information, such as the Type of Encryption, GPS- 
Coordinates, and Channels etc. The equipment also provides the possibility to find out the exact 
location of an unknown Wireless Access Point with the directional Helix-Antenna and the 
included PDA Device. 

With the Wireless Network Detector you are able to see if unauthorized Access Points within 
your Organization are present. 



FEATURES 

• Database-Support to store the information 

• Visualize the Access Points on your own maps 

• Automated WLAN Visualizing 

• PDA solution to locate the Access Points 

• Dual Boot (Windows & Linux) 

• Sirf III GPS included 

• 1 2 V Power Adapters included 

• 512 MB Flash Memory included 

• Ultra-portable High End Notebook 




TECHNICAL DATA 



Notebook 


IBM Tablet Notebook X41 


OS 


Linux/Windows® XP Tablet 


RAM 


512 MB 


Hard disk 


60 GB 


I/O Ports 


USB 2.0, PCMCIA II, 100 Base-TX, 56 kbps Modem, IEEE1394, SD-Card, 
Bluetooth 


GPS-Receiver 


Sirf III - NMEA 


PDA 


Sharp Zaurus C-1 000 


OS 


Linux 


ROM 


128 MB 


Case Size: 


1 00 x 40 x 1 5 cm 


Weight: 


5,0 kg 


WLAN type 


802.11 a,b,g 
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Wireless Network Detector Model 7540 

ILLUSTRATIONS 
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Wireless Network Detector Model 7540 



WLAN DETECTION AND CONTROL SYSTEM 

The WLAN Detection and Control system is designed for TSCM professionals who need to 
know exactly what 802.1 1 RF traffic is present, in and around their target location. By using the 
supplied portable equipment, an operative can survey the target area and map all the RF 
information onto satellite imagery. By looking at the details provided by the system, it is 
possible to identify unauthorized 802.11 devices. With the unique traffic control system it is 
possible to interfere with the unauthorized devices, rendering them useless. 



As well as the overt mapping system, it also comes supplied with a covert detections system. 
The body worn PDA and antenna allows an operator to use the device without being obvious. 
All the data is then transferred onto the main unit to map all information onto the satellite 
imagery. 



WINDOWS BASED LAPTOP CONTROL 
SYSTEM WITH DUAL 802.1 1 b/g 




OMNIDIRECTIONAL VEHICLE ANTENNA 





WINDOWS BASED PDA COVERT SYSTEM 
WITH DUAL 802.11 b/g 
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Telephone Line Analyzer Detector Model 7541 

Second to the physical search, cable and wiring checks are the most time consuming and 
technical. To ensure an effective and thorough cable check, there are over 10 checks for each 
cable, requiring a skilled operative and careful documentation. 

The Telephone Line Analyzer provides a complete integrated suite of tools to analyze, inspect, 
and test digital telephone lines (and other wiring) for taps and other eavesdropping devices. 



Microphone 

Jack 



Bui lh n 
M'cmphone 



Jack 



Tauchucrwn 
8.4 m-di 
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Ftjwer 

BulFon 



Function 

Keys 




Rrrary Dial 



Test 

Dashboard 

VSbw 



Keypad 



PC 
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UEBy'Elhemer 



DC Po¥*er 
Input 



USB Keyboard 
Fan 



Compact Flash 
Mflrrcry ftirt 



TECHNICAL FEATURES 

• Combines multiple testing capabilities into a single piece of equipment 

• Automatic internal pair switching matrix performs tests on all pair combinations 

• Quickly performs common test functions including: 

Multimeter tests (voltage, current, resistance, capacitance) 

RF Broadband Detector (up to 8GHz) 

Spectrum Analyzer (up to 85MHz) 

High Gain Audio Amplifier 
Bias Generator +-80 VDC 

Audio Oscilloscope with active input (20Hz to 20KHz 

• Digital Demodulation to confirm that the telephone line is not passing audio 

• Frequency Domain Reflectometer (FDR) to check for taps on the line 

• Line Non-Linear Junction Detector (NLJD) Functionality to detect electronics connected to a 
line 

• NLJD Line Trace Probe for tracing wires and locating electronics 
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Telephone Line Analyzer Detector 



Model 7541 



Digital Demodulation 

Includes digital decoding capabilities for approximately 80 percent 
of the world's digital phone systems. Demodulation CODECS are 
upgradeable as new phone systems become available. 

Digital Demodulation confirms that a line on a digital phone 
system is not passing audio when it should not. 



Frequency Domain Reflectometer (FDR) 




Similar to a TDR (Time Domain Reflectometer) but based on a 
different technical approach, the Model 7541 's FDR can "shoot" 
a line for impedance anomalies indicating a tap on the wire. 

The FDR also has the ability to plot multiple FDR traces on the 
same display for comparison of multiple pairs or historical 
comparison. 



Non-Linear Junction Detection (NLJD) on a Line 




The Model 7541 includes an NLJD test to detect electronics 
connected to an isolated line. 

This is one of the most powerful tests for quickly determining 
whether or not there are additional electronics attached to a wire. 

The example to the right indicates a parallel tap on pair 4:5. 

Because of the coupling in balanced pairs, any combination with 
either a 4 or 5 indicates some electronic content, but the 
electronics are clearly detected on pair 4:5. 




Digital Multimeter Tests 

The Model 7541 includes basic multimeter tests, such as Voltage, 
Current, Capacitance, and Resistance. 

The automatic switching matrix allows the user to quickly 
measure and display results for all pair combinations, easily 
identifying any anomalies. 

TECHNICAL SPECIFICATIONS 
CONTROL SYSTEM 




Primary Computer: 32bit RISC processor, 520MPIz 
Internal Memory: 64MB SDRAM (OS), 64MB Flash 
External Memory: Compact Flash to 2GB 



DIGITAL I/O 

Network: 10/100 Ethernet Controller 

USB: USB Host (B type) for connection to PC; USB Device (A type) supports external 
keyboard, mouse, and "thumb" drive use 
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Telephone Line Analyzer Detector Model 7541 

ANALOG I/O 

Headphone Output: 3.5mm Mono connector 
Microphone Input: 3.5mm Mono input 

USER INTERFACE 

Hard Keys: 6 Soft menu keys, 5 button quadrant navigation and other dedicated keys 
Encoder: High-resolution optical encoder 
Integrated touch screen with stylus 
Test Inputs: 

Dual MOD8: Supports 2, 4, 6, & 8 wire modular phone jacks 
Banana Type: Standard sleeved sockets: Ring, Tip, and Earth 
SMB RF Input: RF/Antenna connection to 8 GHz broadband detector 
Expansion Port: Supports communication & measurement for use with future 
accessories 

RF SYSTEM 

Spectrum Analyzer: 

Dual conversion, super-heterodyne receiver 
Frequency Range: 1 0kHz to 85MHz 
Sweep Time: 2 Seconds 
Step Size: 1 kHz 
Bandwidth: 18kHz 
Sensitivity: -lOOdBm 
Broadband Detector: 

RF SMB Input: 100kHz to 8GHz 
Balanced Line Test: 100kHz to 600MHz 
Sensitivity: -65dBm 

DIGITAL MULTIMETER 

Range: Quick response auto-ranging, 500msec sample rate 
AC/DC Volts: 0 to 400VDC, 0 to 250VAC 
Resistance: 0 to 40 MegOhm 
Capacitance: 4nF to 400pF 

BIAS GENERATOR 

Optically Isolated, Direct Digital Control: High voltage DAC 
Output Ceiling: + - 80 VDC 

Modulation: Sine, ramp, triangle sawtooth, & square waves up to 300hz. 

AUDIO 

Optically Isolated: Wideband audio path optically isolates user from connection 
Bandwidth: 10MHz at nominal gain of 60dB 
Gain: Up to 80dB total system gain (voice band) 

AGC: Digitally controlled automatic gain 
Filter: Analog voice band filter (300Hz to 3kHz) 
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Telephone Line Analyzer Detector 

POWER SYSTEM 

External Input: 9 - 15VDC @ 3A 

Universal Power Supply: 100-240VAC, 50-60Hz 

Removable Battery: Rechargeable Lithium ion, 4-6 hours of run time 

MECHANICAL 

Dimensions: 9.5in x 12in x 2in (24.1cm x 30.5cm x 5.0cm) 

Unit Weight with Battery: 6 lbs (2.7 kg) 

Case Dimensions: 6.25in x 14.9in x 18.5in (15.9cm x 37.8cm x 47.0cm) 
Case Weight (Including Model 7541 and accessories): 1 1 .5 lbs (5.2 kg) 
Operating Temperature: 0°C to +50°C 




Model 7541 
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Secure Document Scanner 



Model 7542 



The cutting-edge Model 7542 Secure Document Scanner is 
an overall concept for an extremely safe and high standard 
of handling important and confidential paper documents. The 
major components are a completely new developed 
security-paper that acts as a magnetic storage medium, as 
well as a special read-write device with a PC or Laptop 
connection. 




Model 7542 media is writeable and printable using standard 
methods (Laser, Inkjet, Offset etc.). The magnetic memory 
is either invisibly paper-integrated, laminated, or can be 
glued on afterwards. Encrypted data of any kind, like digital 
certificates or information concerning the origin and 
authenticity of the document, can, from now on, be stored. 

The digital document-certificates are administrated through a 
Trustcenter. All memory-data is compared with the 
deposited data after authentication via an encrypted 
connection. The Model 7542 offers state-of-the-art technical 
solutions for document-protection beyond comparison, 
especially developed for high security-demands. 




FEATURES 

ADVANTAGES: 

• Unrivalled proof of document-identity 

• Offers invisible protection 

• Several paper-grades and formats are available 

• Suitable for already existing documents, 
independent of format 

• Manipulation-proof solution through digital 
certificates 

• Encrypted certificate-comparison through a 
Trustcenter 

• A certification is scheduled 

INCLUDED: 

• The Model 7542 starter set with one read-write 
device 

• Single-licence software for Trustcenter- 
accessibility 

• 500 sheets DIN A4, 160 g/m 2 , with internal 
memory 

• 500 sheets DIN A4, 90 g/m 2 , with laminated 
memory 

• Optional individual processing-stations available 

• Additional biometrical user ID possible 
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LAN/WLAN checking system 



Model 7543 



The LAN checking system has come a long way since just checking structured cabling. 
The threat of an IT related attack has heightened bringing with it the need to check IT 
systems. The LAN/WLAN Checking System is capable of performing checks on 
structured cabling and any data present on the line. Its semi automated checks provide 
clear information presented in a printable report. 



Fully Automated - The LAN Checking System provides an instant 
view of the state of the network with its information-rich Autotest 
Results main screen and tri-color LEDs. Multiples tests run 
concurrently, speeding problem discovery. Selecting any individual 
test displays overview information on the left side preview pane; 
Select Details for in-depth test information. 




Cable Checker - Verify the characteristics of UTP and STP copper 
cabling: length, impedance, shorts, opens and wire mismatches 
showing taps, bridges and tampering on the cable and the distance to the tap. 



Signal Verification - Test 802. 3af Power over Ethernet (PoE) 
links. The LAN Checking System can emulate an 8023. 3af 
powered device to solicit and measure voltage on each pin 
showing illegal power activity on the cable. 



Discover unauthorized devices - Discover up to 1,000 
devices and extract switch and VLAN information showing if 
unauthorized devices are present. 
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Discover unauthorized traffic - View your network's traffic statistics, including protocol mix, 
top senders, top broadcasters, and error sources. Identify and locate bandwidth hogs and 
isolate them from the network if necessary. Analyze performance trends with baseline data 
reports. Analyze traffic showing attacks and unauthorized protocols. 



Discover unauthorized wireless devices - Wireless security is a top concern, and wireless 
security policies are difficult to enforce. Use Wireless LAN Checking System to perform periodic 
audits of the wireless environment. Wireless LAN Checking System automatically discovers 
rogue access points, unauthorized wireless bridges, mobile clients and ad-hoc networks, 
enabling quick response and resolution. 



Locate Rogue Wireless AP - An unauthorized "rogue" access point can compromise network 
security by exposing the company's network to the outside world. Use the wireless LAN 
Checking System "Security Scan" feature to identify rogue APs and "Locate" to hunt them 
down 
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LAN/WLAN checking system Model 7543 

Survey RF Site - Use the Wireless LAN Checking System to capture baseline RF coverage data 
immediately after the wireless infrastructure is installed and compare historical data to periodic 
survey data over time. Use this information to make minor adjustments to wireless access 
points, transmit power, relocate access points, minimizing RF leakage or show external sources 
of RF. 

Cable Locating - The breakthrough IntelliTone digital signaling works with the IntelliT one Pro 
Probe to locate voice, data, and coax video cabling through up to two feet of 
sheetrock, Isolating all electromagnetic and radio frequency interference in digital mode. 
Featuring IntelliTone cable mapping; after tracing, use the Tone Probe to verify wiremap. 



Specifications 



RFC 2544 Testing Option (option for LAIM/Pro models) 


Compatible remote device 


EtherScope, EtherScope Series II Network Assistant 


Tests 


Throughput, Latency, Frame Loss 


Frame content 


All Os, all Is, alternating Is and Os, Pseudo Random Bit 
Sequence (PRBS), Incrementing Byte 


Frame size 


64, 1 28, 256, 512,1 024, 1 280, 1 51 8, sweep of all sizes 


Application port 


User defined 


Rate (bps) 


Up to 1000 M (using an EtherScope as a remote device) 


802.1 Q settings 


VLAN Id, priority 


IP TOS settings 


IP Precedence/TOS parameter, Diff Serve Code Point 


Throughput settings 


Duration, maximum rate, measurement accuracy 


Latency settings 


Duration, rate, iterations 


Frame loss settings 


Duration, rate, step size 


Results format 


Tabular, graphical, xml-based report 


Internetwork Throughput Option (included with RFC 2544/ITO Option) 


Compatible remote device 


OptiView v4 Integrated Network Analyzer, EtherScope, 
EtherScope Series II Network Assistant, OneTouch Series II 


Frame content 


All 0s, all Is, alternating Is and 0s, Pseudo Random Bit 
Sequence (PRBS) 
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LAN/WLAN checking system Model 7543 



Frame size 


64, 1 28, 256, 512,1 024, 1 280, 1 51 8, sweep of all sizes 


Rate (bps) 


672 to 1000 M (using an EtherScope as a remote device) 


Duration(s) 


1 to 64,800 (18hr) 


Results 


Frames sent, received, rate and percent loss for both 
upstream and downstream directions 


Results format 


Tabular, graphical, xml-based report 


Traffic generator (included with RFC 2544/ITO Option) 


Traffic type 


Broadcast, multicast or unicast 


Frame type 


Benign Ethernet, Benign LLC, NetBEUI, Benign IP, IP/ICMP 
Echo, IP/UDP Echo, IP/UDP Discard, IP/UDP Chargen, 
IP/UDP NFS, IP/UDP NetBIOS 


Frame size 


64, 128, 256, 512, 1024, 1280, 1518 


Rate 


Utilization (%): >0 - 100, Frames/second: 1 - 1488095 


Duration 


Seconds: 1 - continuous, Frames: 1 - continuous 


Wireless LAN Adapter Card (WLAN/Pro models) 


Specification compliance 


IEEE 802.11a, 11b, 1 1 g 


Certifications 


FCC part 15, Telec, CTICK, ETSI, EN301893, EN60950 
Interoperability WECA Compliant 


Interface 


32-bit Cardbus 


Outdoor operating range 


Up to 515 m (1690 ft) 


Indoor operating range 


Up to 85 m (279 ft) 


Data rate 


802.1 la: up to 54 Mbps, 802.1 1b: up to 1 1 Mbps, 802.1 1g: 
up to 54 Mbps 


Output power 


18 dBm peak power 


Infrastructure mode 


BSS 


External antenna connector jack 


Plirose MS-147 
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LAN/WLAN checking system Model 7543 



Wireless LAN Directional Antenna (WLAIM/Pro models) 


Frequency range 


2.4 -2.5 and 4.9 -5.9 GHz 


Minimum gain 


5.0 dBi in the 2.4 GHz band and 7.0 d Bi in the 5 GHz band 


External antenna connector 
plug 


Hirose MS-147 


Fiber Optic Transceiver (option for LAIM/Pro models) 


Ethernet rate 


1000 Mbps 


Type 


Small Form-factor Pluggable (SFP) 


Connector 


Duplex LC 


Security 


Authentication types 


LAN: 802. IX, WLAN: 802. IX, 802.1 1 i, WEP, WPA, WPA2 


EAP types 


TLS, GTC, MD5, MS-CHAP-V , LEAP, PEAP-GTC, PEAP-MD5, 
PEAP-MS-CHAP-V , PEAP-TLS, TTLS-PAP, TTLS-CHAP, 

TTLS-MS-CHAP, TTLS-MS-CHAP-V , TTLS-EAP-MD5, TTLS- 
EAP-GTC, TTLS-EAP-MS-CHAP-V , TTLS- EAP-TLS 
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TSCM Search Video Pole Camera 



Model 7544 



Sometime during a physical inspection it is not be possible to have the means or time to 
inspect all hard to reach areas. The Video Pole Camera was developed with the aim of 
providing an accurate search of the target location. With its hi-resolution camera and 
screen and 6-foot reach it is possible to get into areas that a search mirror kit cannot. 
Inspect drop ceilings, behind immovable objects, around corners, or other difficult to 
reach areas, even in dark situations with the Video Pole Camera. 

• Cable Basket Runs 

• False Ceilings 

• False Floors 

• Behind, under and over heavy immovable objects 

Inspect drop ceilings, behind immovable objects, around corners, or other difficult to reach 
areas, even in dark situations with the Video Pole Camera. 



The Video Pole Camera provides a small, self contained, easy to use pole camera inspection 
system. The 24-inch pole extends to over 6 feet without changing configuration, giving the 
average user over 1 0 feet of reach. 

White LED illumination for color inspection in dark areas (i.e. drop ceilings) 

IR LED illuminated black and white camera head available for covert or tactical applications 
Large 6.4 inch (16 cm) diagonal, high resolution display, enhanced brightness, color monitor 
No external cables, ready-to-use out of the case 

Collapsible pole, removable camera head, monitor, and batteries fit into a case slightly larger 
than a standard briefcase 
Extremely portable, lightweight, and easy to use 



FEATURES 




Rubber cleats to lift and slide ceiling tiles or 
other objects without the need for a ladder 




Camera Pivots +90* to -25 & 

Wide angle and telephoto lenses included 



Collapsible Pole {6 feet 4 inches to 24 inches} 



Rechargeable Battery 
Pack (2 hour run time) 






Variable LED illuminators for low light 



Flexible camera extension 
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TSCM Search Video Pole Camera 

TECHNICAL SPECIFICATIONS: 

STANDARD COLOR CAMERA HEAD 

Signal Format: NTSC 

Horizontal Resolution: More than 380 Lines 

Sensitivity: 0.5 Lux / FI .2, 1 .0 Lux / F2.0 (AGC ON) 

Illumination: 4 White LEDs with variable brightness control 



Model 7544 




OPTIONAL IR ILLUMINATED BLACK & WHITE CAMERA HEAD 

Signal Format: NTSC 

Horizontal Resolution: 420 Lines 



Sensitivity: 0.0003 Lux / FI .2, 1.0 Lux / F2.0 (AGC ON) 

Illumination: 8 Infrared LEDs with variable brightness control 




COLOR LCD DISPLAY 

Size: 

Brightness: 

Viewing Angles: 

Display Controls: 

Camera Head Controls: 



6.4 inch (16 cm) diagonal 
300 nits 

+/- 50° horizontal, +/- 40° vertical 
color saturation, contrast, and brightness 
variable illumination 



RECHARGEABLE POWER SUPPLY 




Charger and two Ni-MH Battery Packs included 
Average Run-Time: 2.0 Hours 

Average Charge-time: 1 .8 Hours 



MECHANICAL 

Collapsed Length (incl. Camera Head): 
Extended Length (incl. Camera Head): 
Weight: 

Case Size: 



24.5 inches (62 cm) 

6.5 feet (200 cm) 

3.6 lbs (1.6 kg) 

1 8.5x6 x14.5 inches 
47x15.3x36.8 cm 



Case Weight, Pole Camera, Accessories: 1 1 .0 lbs (5.0kg) 



Inspect hard to reach and inaccessible 
areas with the portable, quick-to-deploy 
Video Pole Camera. 
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Video Wireless Detection Model 7545 

The Video Wireless Detection unit is a fast scanning receiver that detects wireless video 
cameras from 900MHz-2.52GHz for quick effective detection of wireless video signals during 
TSCM search operations. 

With a 2.5" TFT color LCD the Video Wireless Detection unit shows you what the hidden 
camera is looking at. A separate smaller LCM displays the frequency and the signal strength of 
the signal the Video Wireless Detection unit locked on to. The Video Wireless Detection unit 
quickly scans, in about 15 seconds, all the available video frequencies used. 

The Video Sweeper works with a full range of video protocols including NTSC, PAL, CCIR or EIA 
systems. The Video Sweeper has both an automatic and manual scan mode and an alarm may 
be activated for an audible alert when a camera is detected. 

The Video Wireless Detection unit can detect some signals from as far away as 500 feet. The 
detection distance depends upon the power output of the transmitter and the sensitivity level 
selected on the unit. The Video Wireless Detection unit has 5 separate receive sensitivity 
settings ranging from -20dBm to -60dBm. 

FEATURES 

• Frequency Range 900MHz to 2.52GHz 

• Detects NTSC, PAL, CCIR, EIA systems 

• Signal strength indicator 

• 5 selectable receive sensitivity settings 

• Audible beeper alert 

• Detection distance up to 500 feet 

• 2.5" TFT color LCD display 

• Scans frequency range in 15 seconds 

• Includes AC adapter, two antennas and case 

• Operates on 4 AA batteries 

• Automatic or manual scan 

• LCM displays frequency and signal strength 

• Audio and Video output jacks for external use 

• Size: 4.75"H x 2.75"W x 1 ,5"D 



TECHNICAL SPECIFICATIONS 



Frequency Range 


900MHz-2.52GHz 


Sensitivity 


-20dBm to -60dBm 


Display 


2.5 TFT color display with LCM display for frequency 


Video Protocols 


Detects NTSC, PAL, CCIR and EIA systems 


Scan Speed 


Scans entire frequency range in 15 seconds 


Size 


4.57"H x 2.75 M W x 1 ,5"D 


Weight 


12 oz. 


Battery 


Internal 4 AA alkaline, NiCD,NiMH batteries (not included) 


Operating Time 


2 hours 


Power 


5vdc, 2amp 1 10-240v center positive adapter included. 


External Connection 


3.5mm mono Alarm and Video output 
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Cable Amplifier System 



Model 7546 



One of the essential tools used within a cable sweep is the Cable Amplifier System. It is 
necessary to use an amplifier to detect hardwired microphones, insert voltage into a line 
to power a hidden microphone and to record the voltage present on the line. 



The Cable Amplifier System is a high gain 
audio amplifier used to detect and identify 
certain types of surveillance devices attached to 
building wiring, such as telephone wiring, LAN 
and server systems, AC Power, and Alarm wire, 
etc. 



It is designed to provide flexible features and 
has proven to be very useful in many situations. 

This amplifier is quite useful for checking 
telephone lines and other wiring for hostile 
microphones, testing for hook switch audio 
leakage, and detection of eavesdropping devices 
that are sensitive to bias voltages or currents 

TECHNICAL FEATURES 

• This multifunctional amplifier has a built in AC/DC digital voltmeter, selectable audio filters, 
and an extremely wide dynamic range 

• Balanced and unbalanced high impedance inputs provide connectivity to a variety of 
suspect wiring 

• The CMA100 also provides a bias voltage adjustable between -15V and +15V DC that is 
used to activate possible devices that are voltage or current sensitive. The bias generator 
is compatible with most types of line conditions 

• All of these functions employ a sophisticated automatic gain control circuit that is superior 
to most audio amplifiers 



SPECIFICATIONS 



Input Impedance: 


50k balanced 


Common Mode Rejection: 


>75 dB 


Maximum Usable Input: 


1 0V p-p 


Preamp Auto Attenuator: 


0 to -20 dB ( with overload warning LED ) 


Automatic Gain Control: 


-20 to +120 dB ( includes preamp auto attenuator ) 


Manual Gain Control: 


0, 25, 50, 75, 100 dB 


Headphone Gain Control: 


0 to 15 dB 


Maximum System Gain: 


1 1 5 dB manual mode, 1 20 dB in Auto Mode 


Frequency Response: 


1 00 Hz to 1 5 kHz 


High Pass Filter: 


300 Hz to 20 kHz 


Low Pass Filter: 


100 Hz to 3 kHz 
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Cable Amplifier System Model 7546 



Band Pass Filter: 


300 Hz to 3 kHz 


Pleadphone Audio Output 


Line-Out Audio Output: 


600 


Bias Control: 


0 to +/-15V DC, 5mA max (over current protected, input 
impedance is reduced to 3k ohms when bias is active) 


Digital Voltmeter: 


3.5 Digit, auto zero, auto polarity, +/-1 99.9V AC/DC 


Power On/Low Battery LED ( LED off @ 6.0V ) 


Maximum Input voltage: 


250V AC/DC 


Leakage Resistance to 
Case: 


>1 0M 


Size: 


7.3"(1 84.4mm) x 2.75"(69.8mm) x 1 .75"(44.5mm) 


Weight: 


12.1 oz (343g) 
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Flat Panel X-Ray System Model 7547 

DESCRIPTION 

The unit is a state-of-the art digital mobile flat panel X-ray system manufactured in Western 
Europe. The flat image converter enables many different applications in the fields of security 
and non-destructive-testing. For EOD use the Notebook provides a save operation by 100 m 
cable or remote control. The high resolution of 127 m allows the identification of even the 
smallest details on X-ray images with more than 16,000 grey levels. 



With its battery operation, its extensive image enhancement software with integrated database 
and most of all its optional visualisation of 3D x-ray images the unit is an unique inspection 
device. Our continuous updates always provide you the latest software versions and our help 
desk will support you with any necessary technical advice. 
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Flat Panel X-Ray System 
FEATURES 
ADVANTAGES: 

• Adaptable to numerous industrial X-ray units 

• Image enhancement, e.g. brightness, contrast, 
correction 

• Helpdesk & free software updates 

• Optional upgrade for 3D X-ray image-visualisation 

INCLUDED IN DELIVERY: 

• High-resolution, digital flat panel detector 

• Image processing & control software (single license) 

• FlashScan control unit & high performance Notebook 

• Power supply 1 00 - 240 V & rechargeable battery 

• Cable set 10 & 50 m; user manual 

• Waterproof, shock protected transport case 

• Supplied without X-ray source! 



TECHNICAL DATA 



Notebook: 


State-of-the-art, 15" XGATFT, > 1,5 GHz, > 40 GB HDD, DVD 


Type of detector: 


THALES FlashScan 35 Fast amorphous silicon TFT-Panel 


Processing time 


< 2 s per image 


Imaging area: 


400 x 280 mm 


Image size (Pixel): 


3200 x 2240 (1 mm 2 ~ 64 Pixel) 


Resolution: 


127 m(~4 Ip/mm) 


Digital output: 


14 bit (> 16,000 grey levels) 


Required X-ray 

source: 


30- 160 kV (e.g. Golden Engineering XR-1 50 or XR-200) 


Battery operation: 


> 2 hrs. (dep. on No of images) 


Dimensions: 


50 x 36 x 4,6 cm (converter) 62 x 50 x 35 cm (carrying case) 


Total weight: 


Approx. 40 kg (excl. X-ray source) 



Model 7547 



filters, sharpness, bump map, gamma 
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GSM Detection System Model 4014 



OVERVIEW 

The GSM Tracer is a system developed as a 
counter-measure to bogus GSM base stations. In 
general, the use of advanced encryption in the 
GSM system means that mobile calls are 
relatively secure. Off-air interception of calls is 
very difficult. An alternative method is to use a 
bogus base station and force a mobile to use this 
in unencrypted mode. Such a system can also be 
used to determine the IMSI (IMSI grabbing) to 
enable interception at the switch. 



This is of particular concern where cell phones 
are likely to be used for sensitive 
communications or in the vicinity of an area thought likely to be subject to espionage. At 
particular risks are: 

• Senior Officials 

• Government Buildings 

• Embassies 

• High Profile Personnel 




By monitoring transmissions from legitimate base stations the GSM Tracer is able to build up a 
picture of the network environment and use this to recognize suspicious transmissions from 
bogus base stations. Key features of the system are: 

• All Networks continually scanned and monitored 

• Compact, portable, easy set up, and configured 

• Display of Encryption type and detection of any changes 

• Programmable alarms for various changes in status 

GSM TRACER 

The GSM Tracer system is a GSM receiver, which constantly scans the GSM control channels 
of all networks (dual band). It looks for changes in the overhead parameters transmitted by the 
genuine network. The GSM receiver will be looking for LAC changes, lack of paging, 'call set- 
ups' without encryption, changes in power, switching encryption off/on etc. The Display shows 
all of the current channels detected, network operator, encryption used, hopping used, and 
amount or absence of pages transmitted. 

BOGUS CELL DETECTION 

By being aware of the transmitted system information on the control channels of legitimate cell 
sites within the area, the GSM Tracer is able to recognize bogus cell sites that are attempting to 
mimic a legitimate site for its own purposes. Once the GSM receiver has latched onto these 
bogus cell transmissions, it then decodes the transmissions, giving the user information such as 
target IMSI. 



The GSM receiver has the ability to perform its own scans based on neighbor lists read from the 
overhead of the genuine cells. 
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GSM Detection System Model 4014 

In a mobile environment, when the bogus cell's target passes through the genuine cells, these 
signal strengths (from the targets perspective) will increase, then decrease, as the target passes 
close by, and then away from the relevant cell sites. In the case where a bogus cell is following 
a target in a vehicle, the transmission will remain roughly constant. This situation can be 
identified by the GSM Tracer system. 



The GSM Tracer is small, portable, and 12V DC powered. It is equally suited for office or in 
vehicle installations. 

ALARM GENERATION 

The GSM Tracer's alarm can be set to trigger on a number of parameters. For example, it could 
be used to indicate when the local cell operators have turned off the encryption and/or 
frequency hopping. This could indicate that they intend to use direction-finding equipment. It 
can also trigger when a channel changes its LAC, which implies a bogus cell is forcing a location 
up-date from mobiles in the target area. 

LOGGING OF SURROUNDING MOBILES 

The GSM Tracer can survey an area from a mobile platform, such as a car. The logs will be the 
signal strength of surrounding Cells as seen by the GSM Tracer with position information from 
an attached GPS receiver. When the GSM Tracer is later located at its stationary position it can 
decode measurement reports from mobiles in the immediate area. These measurement reports 
can be matched with the survey logs giving the position of the mobiles. The mobiles will be 
identified by their TMSI. The survey results are stored in such a way as to be able to be read by 
mapping programs. 

FLUSHING OF TMSI'S 

The GSM Tracer can be connected to a serially controlled GSM mobile. This mobile is 
commanded to send a silent text to a target mobile in the area. The GSM Tracer will see the 
page and can deduce the TMSI associated with the target number. 

USER INTERFACE 

The GSM Tracer is available with an embedded single board computer. Connection of a screen, 
keyboard and mouse will be needed to set up the alarm parameters. Alternatively the GSM 
Tracer can be driven directly from an attached laptop PC via the USB port. The operating system 
used is Windows XP, which has the facility for 'Remote Desktop', where via a VPN connection, 
the operation of the GSM Tracer can be controlled from a remote PC. 

DECODE CALLS 

The GSM Tracer is a dual receiver capable of frequency hopping and following unencrypted 
calls, displaying text messages and recording audio. There is an option to enable the Hound dog 
to decode A5/2 encryption "off air" 



CONFIDENTIAL 



2 



elaman 



GSM Detection System Model 4014 



GSM TRACER FEATURES 

The GSM Tracer system will constantly 
scan the GSM control channels of all 
networks (dual band). The following 
describes some of the features of the GSM 
Tracer software: 

THE CHANNEL SCAN WINDOW 

The Channel Scan windows display the 
power levels detected for each of the 
channels in the bands being scanned as a 
bar chart. Colors are used to highlight 
channels of interest. 



Lrwcr Llflnrt 




The horizontal axis is the ARFCN of the channels. The vertical axis is the power level of the 
channel at this location. 



The colors of the bars indicate different information: 

• Black - Channels that are not broadcast channels 

• Dark blue - Broadcast channels with no cell information 

• Light blue - Broadcast channels with cell information, but 
unknown security 

• Green - A channel ciphered with A5/1 

• Red - A channel ciphered with A5/2 or not ciphered 



A summary of information about a channel can be obtained by moving the mouse pointer over 
it. Clicking on a channel will display more detailed information in the Channel Properties 
window. 

THE CHANNEL LIST WINDOW 

The Channel List window contains a list of all the broadcast channels that GSM Tracer has 
discovered, while it has been scanning, and any information it has gained from these channels. 

There are ten values for each channel in the list: 

• ARFCN - The assigned channel number 

• Network - The name of the network operating the cell serviced by this channel 

• MNC - The Mobile Network Code of the network operator (useful if GSM Tracer does not 
know the name of the operator) 

• Power Level - The last power level detected for this channel 

• Ciphering - The type of ciphering being used (unknown, A5/1 , A5/2 or none) 

• Last Active - The last time the channel was detected sending broadcast information 

• Empty Paging - The percentage of empty paging messages seen on the channel 

• Channel Type - The type of channel being used (IV, V, or VI) 

• Hopping - If the channel uses hopping for dedicated channels 

• Individual Settings - If there are individual settings for alerts about this channel 




CONFIDENTIAL 



3 





elaman 



GSM Detection System 



Model 4014 




ALERTS 



There are a number of events that will trigger the GSM Tracer alerts, all of the parameters can 
be set, and the corresponding reporting can be selected. 



• A5/1 Ciphering 

• A5/2 Ciphering 

• No ciphering 

• LAC changes 

• No calls detected 

• Channel lost 

• Channel detected 

• Power increase 

• Power decrease 

• Channel type changes 

• Amount of paging 

• Extra info 

• Error 

• Fatal 




On the left side of the dialog there is a list of all the events 
that can occur while GSM Tracer is scanning. For each of 
the events there are two selection boxes. The left hand box 
sets the log level of the event, this will display the event in 
the 'Alert' or 'Info' display. 



For change in Power levels, levels in Empty paging, and the 
time a Channel is lost, there is a further screen to set the 
levels of the Alert trigger. 

DISPLAY WINDOW 

• Window 

• Channel List - Displays the Channel List window 

• Lower Band - Displays the Channel Scan window for the 900 or 850 band 

• Upper Band - Displays the Channel Scan window for the 1 800 or 1 900 band 

• Channel Properties - Displays the Channel Properties window 

• Alerts - Displays the Alert Log window 

• Errors - Displays the Error Log window 

• Information - Displays the Information Log window 
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Night Vision Viewer Model 1013 

The Model 1013 Night Vision Viewer Unit is used for TSCM purposes to detect large laser 
monitoring systems (890NM) and fiber optical microphones. 

The Model 1013 is designed to offer the largest selection of cameras available for the user. If 
your application calls for video surveillance (Sony, Canon, Panasonic, etc.), you can order the 
required adapter pairs. 

If you also need to record using an SLR or digital camera, (Canon, Nikon or Minolta), just order 
the adapters for these cameras and switch back and forth. 




Central Intensifier Unit with Monocular Viewer 

The heart of the modular night vision is the CIU (Central Intensifier Unit), an electro-optical 
device with electronic communication that ensures proper interface between the camera and 
the lens. 

A variety of Gen II, Gen III, and Gen IV XD-4 Central Intensifier Units allow you to tailor a system 
in terms of resolution, sensitivity, spectral response, gain, output brightness and budget. 

Dark, moonlit or starlit nights can easily be recorded and imaged as bright, high-resolution 
scenes by the camera's daylight sensor or film. The Model 1013 extends the camera's usable 
light range without the drawbacks of slower shutter speeds or time integration. 

As new cameras and technologies are introduced, new camera and lens adapters will be 
developed for the Model 1013, ensuring that your night vision system will never become 
obsolete! After you choose the adapter pairs (depending on the camera or camcorder you are 
using) you must choose the Central Intensifier Unit suited for your applications. 




Digital and 35mm 
Still Cameras 



Video Camcorders 




C-Mount CCD Cameras 
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Covert Door Opening Equipment 



Model 2001 



THE KIT CONSISTS OF: 

1 . 1 "Sputnik" 

2. 1 "Tubular" 

3. 1 Multi-Lock Pick Set 

4. 1 E-Pick Professional Set "New 

Generation" 

5. 1 Door Opening Set" 

6. 1 Dental Pick Set 

7. 1 Falle Lock Picks 

8. 1 Pin Tumbler Decoder 

9. 1 Hobbsche Hooks (Set of 4 

different sizes) 

1 0. 1 Cross Pick 

11. 1 Matador Pick Set 

12. 1 Duplicate Key Set 

13. 1 Multi-pick Set 

14. 1 Multifrafte 

15. 1 Lock-force "Professional Set" 

16. 1 Tension Set (25 pieces) 

17. 1 Milwaukee Mobil Reloader 

18. 1 Accu-Light 

19. 1 Replacement Lights (2 Pieces) 

20. 1 Accu-Driller Lock-Tor 

21. 1 Replacement Accu 

22. 1 Kitbor Chubb Lever Set 

23. 1 Jiggler Set (3 different Sets) 

24. 1 Circle Manipulation Spiral-Needles 
(4 diff. pieces) 

25. 1 Circle Manipulation Spiral-Needles 
small (2 pieces) 

26. 1 Door Rod 

27. 1 Window Opener 

28. 1 European Percussion Spring 
System 



29. 1 Door Panel Manipulation Hook 

30. 1 Door Manipulation Card incl. 2 diff. 
Holders 

31. 1 Manipulation Set for Lever Locks 
(13 Diff. Sizes) 

A: Length: 75mm Shaft: 45mm (10 
Pieces) 

B: Length: 90 mm Shaft: 60mm (16 
Pieces) 

D: Length: 90 mm Shaft: 60mm (20 
Pieces) 

F: Length: 90 mm Shaft: 60mm (24 
Pieces) 

G: Length: 90 mm Shaft: 60mm (24 
Pieces) 

H: Length: 90 mm Shaft: 60mm (24 
Pieces) 

J: Length: 100 mm Shaft: 80mm (12 
Pieces) 

K: Length: 100 mm Shaft: 80mm (12 
Pieces) 

L: Length: 100 mm Shaft: 80mm (12 
Pieces) 

M: Length: 100mm Shaft: 80mm (24 
Pieces) 

N: Length: 150mm Shaft: 120mm (24 
Pieces) 

O: Length: 110mm Shaft: 80mm (15 
Pieces) 

P: Length: 150mm Shaft: 120mm (12 
Pieces) 
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IT/Computer Threat 



IT Threat 



For every action there is an equal and opposite reaction. The same is true for 
IT/Infrastructure Security. For every security measure employed, soon enough there 
will a method TO break through it. 

With the advancements in digitization and technology more and more communications 
systems are becoming digitized and computerized. Analog telephone systems are migrating to 
ISDN. ISDN is migrating to Voice over IP. Wired networks are migrating to wireless networks. 
One of the obvious threats from this is interconnectivity. A reason and advantage for 
digitization and computerization is interconnectivity - multiple systems being able to speak to 
each other across great distances. The telephone system in Germany is connected to the 
telephone system and administration system in Canada. Although useful for the company 
employing the system, it is just as useful for the eavesdropper, who is able to attack the 
system from anywhere in the world and at any time. 



Although countermeasures and attacks are constantly over taking each other there is still the 
need to employ security. Countermeasures are still going to be effective as a deterrent and an 
obstacle for the attacker. Slowing down the attack or simply making it too much effort can 
prevent a successful attack. 

One of the best countermeasures is knowledge. Educating users and operators to employ 
their own security, use the system safely, and have the ability to recognize the signs of an 
attack are a large proportion of IT TSCM. 

Following are just some of the attacks employed that all users should be aware of: 



Time Bomb 
Logic Bomb 
Rabbit 
Bacterium 
Spoofing 
Masquerade 
Sequential Scan 
Software Malfunction 



Dictionary Scan 
Digital Snooping 
Shoulder Surfing 
Dumpster Diving 
Browsing 
Spamming 
Tunneling 

Equipment Malfunction 



Back Door 



Information Security 

A large amount of information is readily available for an attacker to use to carry out attacks. By 
being able to recognize areas of weakness users can proactively be more secure with 
information, thus reduce the opportunities for a potential attacker. The examples below show 
information found on the internet that would be useful to an attacker. It is quite easy, without 
knowledge, to inadvertently publish secure information on the internet. 
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IT/Computer Threat 



IT Threat 



?Jhais Server Version 2.1 Et whois.tmEgnic.net 

database contEins ONLY .COM, _ NIT r ..TV, _CC do 

Owne r Cant act : 

Gottfried lens 
AVM 

SchulhEusstresse 2 1 



Index of /ete/passwd 



last modifred 



Size Pe3C-ipticr. 



Oberwil-Iieli r 8366 r CH 


Parent Directory 


31 


-Jul-2003 


12 : 36 




Puny code He me : date-alliance . cam 


Ar-admin.cqi 


31 


-Jul-2003 


12 : 55 


2k 


Uni cade Name: da t a - a 1 1 i anc e . c am 


[3 Count. cgi 


31 


-Jul-2003 


12:55 


3k 


Admin Cant e at 

Gattfried Lanz 
AVM 


3 CrazvWWW3oard. cai 


31 


-Jul-2003 


12:55 


3k 


13 Search.pl 


31 


-Jul-2003 


12:55 


9 k 


■* ■* * l|| E — V - IE. . ch 

S chulhaua atraaae 2 1 


3 WSETP.LOG 


31 


-Jul-2003 


12 : 55 


309k 


Cb e Ewi 1 -L i e 1 i r 8966 r CH 


3 Ya33.pl 


31 


-Jul-2003 


12:55 


5k 


phone : H +49.566412056 0 


3 vti inf . T.trr.1 


31 


-Jul-2003 


13:06 


Ik 


Technical Cant act 


13 ecce33.log 


31 


-Jul-2003 


12:55 


141k 


Gattfried Lens 
AVM 


lift 

LrrJ accounts . txt 


31 


-Jul-2003 


12:55 


22k 


****@B-v-m. ch 
Schulhausstrasse 2 1 


13 edir.in.db 


31 


-Jul-2003 


12:55 


51k 


Cfcerwil-Lieli r 8966 r CH 


13 a dmi ni s t rat o rs . pwd 


31 


-Jul-2003 


12:55 


Ik 


phone : H +49 . 5 6641 20 5 6 <d 


13 administrators .pwd. i . 


.> 31 


-Jul-2003 


12:55 


2k 


Zone CantEct 


1^^ adpassword.txt 


31 


-Jul-2003 


13:07 


Ik 


Gattfried Lens 
AVM 


ra 

L=J ad.cgi 


31 


-Jul-2003 


13:07 


2k 


* * * * q - — v— m . ch 
S chulhaua at ras a e 2 1 


13 arr.a dir.r n . p 1 

[TU 


31 


-Jul-2003 


12 : 55 


3 k 


Oberwi 1-Lie li, 8366 , CH 


S e. j. ctr :r. :ee. r ‘er . tl 


31 


-Jul-2003 


13:10 


9 k 


phone : S +49.566412056 # 


13 auth user file.txt 


31 


-Jul-2003 


13:10 


3k 


Record empires on: 2008-04-06 16:34:08 


13 a ut ho r 3 . pwd 

run 


31 


-Jul-2003 


12:55 


Ik 


Domain servers in listed order: 


S autT. : r z . f..c. . zr.c.ex 
run 


31 


-Jul-2003 


12:55 


ik 


nsl . a e dap a r king, cam 217.160. 9S. 34 
ns 2 . a e dap a r king, com 217.160.141.42 


IS backup 


15 


-Jul-2003 


03:33 


940k 


13 fcasT. history 

run 


31 


-Jul-2003 


12:55 


12k 




L=] fcb-T.rst . sh 
run 


31 


-Jul-2003 


12 : 55 


2k 


Hardware Security 


IS cos f cruir.. ecu 
fGTi 


31 


-Jul-2003 


12:55 


6k 



It is a common belief that all potential attacks are based around remote access and networks. 
This is far from the truth and some of the most lethal attacks are committed at the computer. 
Generally, computer hardware and configurations are very secure and provide ease of use for 
the user. This is a huge area of weakness in what could be a very security conscious system. 
Giving an attacker 30 seconds of access to a computer can result in masses of secure 
information being gained without the user's knowledge. This would also be the ideal time in 
which to prime the machine for future, more lethal attacks 



By knowing how these attacks take place it is possible to introduce preventative action and 
secure all areas of potential weakness. 
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IT Threat 



Keyloggers 



USB Attack 





Password Cracking 



System Destruction 





Network Security 

By the very nature of networks, fluid communication, they are generally an ideal target for 
potential attacks. With access to a mass of devices from one entry point, an attacker has the 
potential to gain information from many different sources. 

Sniffing 

An attacker is able sit on a network without the need to show his presence of actively 
attacking specific machines. Just by simply sitting on the network and watching the 
information passed around, it is possible to extract secure data and information for possible 
future attacks 
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IT/Computer Threat 



IT Threat 



Ettercap flG-D. 7 .D 



Start Targets Hosts View Mitm Filters Logging Plugins 



Connections K 



Profiles * 



IP Address 



Hostname 



169.254.1.1 

169.254.1.30 

169.254.1.31 
X 213.140.2.32 



X 195.130.225.172 



169.254.1.40 



Purge Local 



Purge Remote 



Convert to Host List 



Dump to File 



Unified sniffing was stopped, 
Starting Unified sniffing... 



POP 

POP 

POP 



213.140.2.32:110 -> USER: M 
195.130.225.172:110 -> USER- 
213. 140.2.32: 110 -> USER: Mi 



I PASS: 







E 






VoIP Attacks 

Voice over Internet Protocol is becoming very popular due to the ease of mass installation and 
low cost. It is a very effective means of communication but also a potential hole in secure 
system. By sitting on the network, or leaving a small device monitoring the network, an 
eavesdropper is able to record all conversations as well as extract usernames and passwords. 
By being able to identify this weakness it is possible to provide measures to ensure a system 
is safeguarded. 



a ip crack 0.1 [ majoc.u vw . EE-jQ-E-exrLnit . or g ) 



| *■ reading and parsing dump f ele 

| * found account a: 



num 


ser rer 




client 






user 


algorithm 


hash / password 


1 


132.160. 


19. f 1 


192. 16B. 


.19. 


.120 


500 


plaen 


12235 


2 


192 . 16B . 


19.il 


192. 16B. 


.19. 


.120 


500 


plain 


2 3 a ft e r 1 2 


2 


192. 16B. 


19.: 1 


192. 16B. 


.19. 


.120 


500 


md5 


d2bc 1 0c 3 f 2 c 9 c 2 7 5 f e 7 da 2 f 2 0 f 17 6 0 0 f 


dj 


192. 16B. 


19. Bi 


192. 16B. 


.19. 


.120 


500 


end 5 


e 5 S 2 7dB c da 2B5252d5ceB7 a dB e 2 c 6 3 c a 


5 


192. 16B. 


19.il 


192. 16B. 


.19. 


.120 


500 


md5 


6 52 3 e 2 6 5 2 lb 0 dd7 7 e £ a B 7 c ede 2 6b 3 a f 2 


* SE 


lect which 


entry 


to crack 


[1 


" 5) 


: 2 







| * generateng static md5 hash la23s6Ef a3903bdBce0i:7a2fc2' 1, f £ f ar 2 

| * starting bmtcfarce against user r 500 e Imd5 hash: 'd2bclUE3f2c9c275fE7da2f2uf 17600f 1 } 

i A loaded imrdliat: r h=ig - yordliat .Pact; r 

I * tried B3626B6 passwords m 12 seconds 
\ ~ f ound password: r alfc2c2 r 

[ ~ up dan eng 1 1 o gens - s ep . tit r done 
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IT Threat 



Wireless Security 

802.11 networks are now replacing the conventional structured cabling networks due to the 
ease of installation and cost effectiveness. By providing a wireless network, blanket covering 
an area, there are several security implications involved. 

It is not always possible to prevent the network leaking out into the public domain. By not 
knowing where the network presence is, it is not possible to know whether it is possible for 
an attacker to be able to access the network from the public domain. 




802.11 security poses one of the largest threats for IT. There are several security methods, 
some more secure than others. Without knowledge it is very easy to inadvertently use an 
insecure method. With wireless security being able to be broken within 10 minutes it is 
possible for an eavesdropper to have a presence on what you believe is a secure network. 
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IT Course 



IT TSCM COURSE 

The IT TSCM course is intended to provide participants with the necessary knowledge to help 
install countermeasures and proactive procedures within an IT Environment. 

With a mixture of theory and hands-on practice the participants will be shown the common 
attacks in IT and, if possible, how to safeguard against them. 

By the end of the course the participants will be able to: 

• Identify sources of threats 

• Indentify threats 

• Indentify potential areas of weakness 

• Recognize a threat/potential threat and provide countermeasures 

• Perform 802.1 1 site surveys 

• Perform cable and traffic analysis 

• Structure security policies 

• Perform basic penetration testing 

Windows Password Cracking Voice Over IP Interception 



Methods in proactive protection and penetration testing will be taught, including User 
Authentication Methods, Encryption, Hardware Protection as well as practical hands-on 
deployment of the systems. 



The latter part of the course is aimed at TSCM Products being used effectively in the field of IT 



Email Sniffing 
Password Sniffing 
Wireless Cracking 
Website Defacement 
Information Scavenging 



Physical Attacks 
Network Attacks 
Bluetooth Hacking 
Mobile Phone Hacking 
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IP/PABX Manipulation Software Training 

RECOMMENDED SOFTWARE 
INTRODUCTION 



Ref. 


Model 


Description 


1 


Model 4011-01 


Advance War Dialing Software 


2 


Model 4011-02 


Netlntercept S200 Appliance 


3 


Model 4011-03 


AccessData© Password Recovery Toolkit™ 


4 


Model 4011-04 


AccessData® Distributed Network Attack® 


5 


Model 4011-05 


AccessData ® Registry Viewer™ 


6 


Model 4011-06 


AccessData® Forensic Toolkit® 


7 


Model 4011-07 


AccessData® Ultimate Toolkit ™ 



As Internet gateway controls tighten, hackers are returning to an easier, often forgotten route 
into the network unsecured, back-door modems. 

OBJECTIVES 

To identify any unauthorized modems connected to corporate systems that provide a route 
into the network by an attacker. To attempt to break-in through any modem or RAS server 
undetected. This is achieved by using software to dial through the company's telephone PBX 
range. Once systems are identified, attempts are made to breach the underlying OS and to 
attempt default account password logins. 

DESCRIPTION 

While it is vital to secure your Internet perimeter, it's equally important to secure potential 
back-door routes into your network. Unauthorized or poorly configured modems connected to 
your systems could give an attacker direct access to your internal network. 



In our experience modems are found on between 1% to 4% of corporate telephone lines. So 
for a DDI range of 1,000 numbers, we expect to see between 10 and 40 modems. 



Routinely detecting the presence of unauthorized modems by a physical walk-through of office 
space and manual telephone dialing is impractical for most organizations. 



War-dialing service is designed to solve this problem. Our service aims to train personnel to 
locate unauthorized modems and identify the type of system connected. 



From here you can attempt to gain access to the corporate network through this point or 
simply flag up the modem to the client for investigation and remove it if necessary. 
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IP/PABX Manipulation Software 



Training 



Test Phases of war dialing setup 

1 . Review your asset register of authorized modems and fax numbers 

2. Scan your telephone PBX range 

3. Record which numbers respond with an electronic tone 

4. Identify which of these are fax numbers and remove 

5. The remaining set can potentially be modems or RAS servers connected to computer 
systems 

6. Attempt to connect to each modem and grab modem & system banners 

7. Research 'signature' of system on Internet search engines to see if the system, 
product manual and default accounts can be identified 

8. Attempt common/default account passwords 

9. Record numbers that are continually 'busy' during the test period for investigation 

SOFTWARE MANIPULATIONS 

Kinds of manipulations 

1. Manipulation and misuse of regular features (e.g. hands-free answer back or "virtual" 
conferencing) 

2. Activation of hidden features (e.g. witness function, service observing or "lawful" 
interception) 

3. Adding new self-created features (own programs) to the PBX 
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Software Description 



4011-01 



MODEL 4011-01 - ADVANCE WAR DIALING SOFTWARE 

GASCAN is an on ISDN-based Dialer that uses the War dialer principle to call phone numbers. 
The call results are analyzed to identify the remote devices. 

GASCAN allows you to: 

• Perform security audits to identify vulnerabilities of external PSTN entry points like 
Modems, Fax, PCs, Router, Remote Access Systems, any ISDN application and Unified 
Messaging Systems 

• Automate the revision of your PBX configuration and devices 

• Check the implementation of your outsourced PBX and telecommunication infrastructure 

• Document your telecommunication infrastructure for your facility management 

• Optimize your telecommunication infrastructure 

• Simulate heavy load for quality checks of your services and products 

SPECIAL FEATURES 

• Least Cost Routing 

• Support for using PBX switching technology 

• Hides caller ID 

• A remote control is possible by using Remote Access capabilities of the operating system 

• One PCI or PCMCIA GASCAN adapter is included, that supports one ISDN BRI line with 
two b-channels. 
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Software Description 4011-02 

MODEL 4011-02 - NETINTERCEPT S200 APPLIANCE 

Capture, Analyze and Discover the Network Traffic Driving Your Business. 

Detailed Information about the system can be found in the separate document 

The S200 appliance running Netlntercept 3.0.2 includes 

• 1 Intel P4 2.4 GHz CPU 

• 1 GB DDR266 MHz SDRAM 

• 1 10/100 MB Ethernet Network Interface 

• 1 10/100 MB Ethernet Network Interface Card 

• 250GB SATA/150 7200 RPM drive, 8MB Cache 

• 200GB usable by Netlntercept 

• 2U Rack mount Case 

• 52x24x52 CDRW 



This position includes one year of software support and updates. 

Due to the sensitive nature of this software we require an end user with his contact data due 
to export legislation, license and support issues. 

OVERVIEW 




Most network monitoring tools cannot provide all the information that security professionals, 
IT managers, network administrators, auditors, software developers, and analysts need to 
know. The only way to richly and completely know how your network is being used is to 
capture the data packets and analyze them in detail. 



Network consultants know the value of this information, even when it comes with a high 
manpower cost. They will run a packet Sniffer like TCPdump to capture raw network traffic 
into disk files, and then inspect the data with programs like strings. This yields only a brief and 
confusing glimpse into traffic data - and it is manually intensive and massively time- 
consuming. NETINTERCEPT (Nl) is a network monitoring and analysis system. 
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Software Description 4011-02 

NETINTERCEPT is delivered as a complete system, with hardware and software pre-installed, 
ready to be placed in a machine room or NOC and plugged into the network at the firewall 
border. 

To use NETINTERCEPT, an IT manager simply connects the system; no configuration is 
required to monitor and analyze traffic from the system's console. Unlike Intrusion Detection 
Systems (IDSs), it doesn't actively look at traffic and report events in real-time. Instead, it 
records all traffic on the hard drive, writing over the oldest information when the storage limit 
is reached. Thus, traffic from the last several hours, days, or weeks (depending on the size of 
your NETINTERCEPT configuration and average bandwidth) is available for study. Traffic is 
selected via the user interface, and then analyzed in batch mode. A typical user would begin a 
batch analysis: 

• After noticing a traffic peak 

• Because an event was logged by a network management system 

• After receiving an alarm from an IDS, or 

• As a core part of any overall security monitoring strategy 



After an analysis, all network traffic in the selected interval becomes available to system 

administrators through an easy-to-use graphical user interface (GUI) and printed reports. 

NETINTERCEPT can be used either sparingly (an occasional half-hour to review recent alerts), 

or continuously (as part of a full-scale effort to optimize network infrastructure, monitor 

network usage, or study an attempted break-in). NETINTERCEPT lets users: 

• Study an external break-in attempt 

• Monitor correspondence and watch for confidential data being sent outwards 

• Display the contents of a remote login or a web session 

• Be aware of unusual or potentially troublesome traffic on the network 

• Reconcile the relationships between hostnames and IP addresses in network traffic 

• Use the GUI to interactively view traffic categorized or sorted by dozens of attributes, such 
as time of day, username, client and server machine identities, or session size 

• Select connections of interest by criteria, such as keywords found in e-mail header fields, 
Ethernet addresses, TCP or UDP port numbers, file names, and Web Uniform Resource 
Identifiers (URLs) 

HOW NETINTERCEPT WORKS 

NETINTERCEPT is designed to work in three major steps: 

1. Capture Network Traffic 

• Packets are automatically captured from a 10/100/1000 BaseT LAN or compatible packet 
monitoring port on a high -speed switch 

• Packets are stored on NETINTERCEPT's hard disk in TCPdump-format files. As new data is 
captured, it replaces older data on a first-in, first-out basis 
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Software Description 4011-02 

2. Analyze Network Traffic 

• The user selects a time interval of interest, and the system protects data from that interval 
from being overwritten by new data 

• Packets from the time interval are reassembled into individual data streams (sequences of 
related packets) and saved to disk 

• Each data stream is passed through the NETINTERCEPT analysis engine, which attempts to 
recognize the protocols and content using a hierarchical set of parse modules. The parsing 
process allows NETINTERCEPT to detect spoofing by interpreting the content of data 
streams, rather than making a guess based solely on packet headers and port numbers 

• NETINTERCEPT extracts search criteria so the user can readily find specific network 
transactions. The parse results and analysis conclusions are stored in a database 

3. Data Discovery 

• Users can browse interactively through NETINTERCEPT's results database using the GUI 

• Users can instruct NETINTERCEPT to generate a variety of detailed reports from the 
current database 

CAPTURING NETWORK TRAFFIC 

NETINTERCEPT captures network traffic using a modified UNIX kernel and a standard 
Ethernet interface card placed in intercept mode. The capture subsystem runs continuously, 
regardless of whether the GUI is active. Tests by Sandstorm have demonstrated a 99.9% 
capture rate on a fully-loaded 100Base-T network, and 99.99% capture rate on a lightly-loaded 
network. 

Long term archival storage of captured data in NETINTERCEPT is accomplished by storing the 
raw dump files. The archived dump file can be written directly to a removable media device 
attached to the NETINTERCEPT machine, or transferred over the network to other machines 
for archiving. Because the file format is compatible with the Unix TCPdump utility, dump files 
captured by NETINTERCEPT can be transferred to other computers and analyzed with other 
tools, if desired. 
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Software Description 4011-02 

ANALYZING NETWORK TRAFFIC 

NETINTERCEPT performs stream reconstruction on demand. When the user selects a range 
of captured network traffic to analyze, NETINTERCEPT assembles those packets into multiple 
streams. NETINTERCEPT can identify over 85 types of data streams, including FTP, HTML, 
telnet, e-mail with attachments, Microsoft documents (including Word, Excel, and 
PowerPoint), and nested data such as images or documents inside TAR files. Because the 
parser uses a nested hierarchy of modules - each specialized to parse a type of data - the 
architecture is very clean and easily extensible. The reconstructed TCP and UDP streams are 
then presented to the NETINTERCEPT analysis subsystem for identification. 

The analysis modules are arranged in a tree structure. Each module specializes in a particular 
protocol, and may pass portions of the data stream both to child modules for lower-level 
analysis and back to parent modules in the case of compressed, packaged, or encrypted 
content. Modules that find data useful as search criteria or for statistical purposes extract and 
store that information in an SQL database. 



File-like objects (web pages, e-mail attachments, etc.) encountered can also be stored. A 
pointer to the object and a unique code generated from an MD5 hash of the object are stored 
in the NETINTERCEPT SQL database, while the object itself is stored to the hard disk. By 
storing pointers, NETINTERCEPT saves each unique object only once, thereby saving disk 
space. 




BROWSING AND DISCOVERING 

NETINTERCEPT stores a permanent record of all data traffic and the conclusions of its 
analysis, with links to supporting information. The NETINTERCEPT GUI displays information 
stored in this results database. The GUI can be used either via the system console, or 
remotely over a secure, encrypted X Windows connection to a display elsewhere. 
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Software Description 4011-02 

• Main Window. This window contains tabs to allow the user to view summary information 

from the overall packet stream, then drill down for detail on the connection session 

• Traffic Tab. Shows an interactive display of network traffic volume over time 

• Summary Tab. Shows a big-picture overview and summary statistics for the current 
database 

• Forensics Tab. Allows selection (from lists of criteria such as content type or username) 
of network connections for deeper analysis in the Connection Examination window 
(described below) 
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Software Description 



4011-02 



• Alerts Tab. Lists unusual or suspicious activities NETINTERCEPT has discovered, 
including attacks, security violations, and network errors. 





• Views Tab. Displays thumbnails of all graphic images discovered in the packet stream. 
Allows browsing of host-to-host connections. Displays web pages reconstructed from 
network traffic 



CONFIDENTIAL 



7 




elaman P 

«»M*N (KUHTT igiUTIDNI V 



Software Description 



4011-02 





• Configuration Tab. Controls data capture and analysis settings and defaults 

• Connection Examination Window. Detailed information on a particular network 
connection 

• Traffic Session Tab. Displays the actual data stream (and optionally packet headers) from 
the selected network connection 

• Summary Tab. Displays traffic summary of the selected connection including search 
criteria values found 

• Conclusions Tab. Contains results of NETINTERCEPT's content analysis and access to 
any file data elements found 
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Software Description 4011-02 

• Criteria Tab. Exposes Forensic search criteria that selected this network connection 

Other windows of interest include Packet View, Web View, Image View, and Report 
View. 



NETINTERCEPT also includes a variety of convenient and easy-to-use reports that users can 
generate in plain text or HTML format, or display through the NETINTERCEPT GUI. Each 
report is created from a template, which can be edited by the user to produce customized 
reports for specific applications. Report types supported in NETINTERCEPT include: 

• Traffic Reports. Provide details of network traffic volume among machines on the 
monitored network 

• Content Reports. Provide descriptions of content (such as web pages or email) that was 
part of your network traffic 

• Network Description Reports. Provide summary information about your network 

• Focus Reports. Show network traffic for a specific user, hostname, or IP address 

• Security and Protocol Hygiene Reports. Show breaches in network security or network 
traffic anomalies 

RUNNING NETINTERCEPT AUTOMATICALLY 

NETINTERCEPT contains scripting components to automatically save, parse, export, delete 
and report on traffic from the monitored network. These components can be assembled into 
shell scripts and scheduled to run on a timetable appropriate to the volume of traffic being 
monitored. 

SSH AND SSL DECRYPTION 

NETINTERCEPT offers the capability to decrypt SSH sessions to and from systems that have 
been modified to support this activity using an asymmetric encryption key escrow mechanism. 
One copy of Nl is capable of decrypting traffic from any number of SSH hosts so modified 
(provided that the traffic appears on the monitored network). This capability works with both 
SSH-1 and SSH-2 sessions. NETINTERCEPT also offers the capability to decrypt SSL sessions 
to and from SSL servers you control. This is accomplished by importing the server's private 
keys into NETINTERCEPT. One copy of Nl is capable of decrypting traffic from any number of 
machines running correctly configured SSL servers (provided that traffic appears on the 
monitored network). This capability works with all versions of SSL up to 3.1 (TLS 1). 

PRIVACY PROTECTION 

For more than twenty years, network monitoring tools have made it possible to covertly 
monitor data moving between computers over a network. NETINTERCEPT's ability to parse 
and understand data types is a valuable protector of individual privacy because it allows 
network managers to surgically examine data on a crowded network without accidentally 
viewing information that is unrelated to an investigation. 

Specifically, NETINTERCEPT has the following privacy-protection features: 

• Collects and graphically display network utilization, without analyzing the content of the 
traffic 

• Selects suspicious or unusual traffic for display by hostname, protocol, or username, 
without viewing others' data 



CONFIDENTIAL 



9 



elaman 

«■ V / 



OEKU4H (KUIITlf igiUTIDNI 



Software Description 4011-02 

• Views captured images without associated username information, unless desired 

• Specifies what types of data will be analyzed in the traffic or stored in the permanent 
database 

• Password-controlled access to the NETINTERCEPT hardware, software, and data 

• Audit logging of all triggered analysis activities 

NETINTERCEPT CONFIGURATIONS 



S series 


For DMZs and 
simple analysis 

purposes 


Captures up to 95 Megabits/second burst rate 




Parses up to 5 Megabits/second sustained average 
data rate 






Single P4 CPU 






Up to 95 GB data storage, 1 GB RAM 






(2)10/100 Ethernet interfaces for monitoring and 
control 


Standard 2U rack size 


DR series 


For extended 


Increased capture and analysis rate with 




performance 


4 way RAID controller and Dual Intel XEON CPUs 






Up to 300 GB data storage, 1 GB RAM 






(2)10/100/1000 Ethernet interfaces for monitoring and 
control 






4U rack size 


DRG series 


For backbones and 

advanced 

requirements 


Captures up to 300 Megabits/second burst rate 




Completely parses up to 10 Megabits/second 
sustained average 






data rate 






8 way RAID controller and Dual Intel XEON CPUs 






Up to 770 GB data storage, 3 GB RAM 






(2)10/100/1000 Ethernet interfaces for monitoring and 
control 






4U rack size 
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Software Description 4011-03 

MODEL 4011-03 - ACCESSDATA© PASSWORD RECOVERY TOOLKIT™ 
(PRTK™) 

The Password Recovery Toolkit is perfect for law enforcement and corporate security 
professionals. If you need access to locked files or if your users have simply locked 
themselves out of their files, the PRTK can get you back in. 

SECURITY RISK ASSESSMENT TOOL 

Many people use the same password to gain access to different programs and network login 
areas. This could be one of the weakest links in your organization's security profile! Some 
password protection schemes are easy to crack, while others are virtually impossible. But 
what if the same password is used for both programs? By gaining access to the weakest one 
you have gained access to the strongest one without the need to crack both. 

FEATURES 

• Enables password management 

• Analyzes files and their passwords with an optional report file 

• Recovers all types of passwords regardless of password length 

• Analyzes multiple files at one time 

• Recovers multilingual passwords 

• Prevents unauthorized use with a personal security code 

• Free technical support between 8:00 A.M. to 5:00 P.M. MST 
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Software Description 4011-03 

PASSWORD RECOVERY MODULES 

AccessData has a wide variety of individual password breaking modules that can help you 
recover lost passwords for almost every product in the industry. 

Individual Password Breaker Modules 



MS Access 


Mail (MS) 


QuickBooks 


ACT! 


MS Money 


Quicken 


Ami Pro 


MYOB 


WinRAR 


Approach 


My Personal check 


Scheduler-i- 


ARJ 


Writer 


Symphony 


Ascend 


Norton Secret Stuff 


Versa Check 


Backup 


Organizer 


MS Word 


Best Crypt 


MS Outlook 


WordPerfect 


Bullet Proof FTP 


Palm 


Word Pro 


Cute FTP 


Paradox 


Adobe PDF 


Data Perfect 


PGP Disk File 4.0 


Win95/Win98 PWL Files 


dBase 


PGP Secret Key Ring 


IE Content Advisor 


Encrypt Magic Fldr 


Pro Write 


W E_FTP 


Excel 


Project (MS) 


Netscape Mail 


FoxBASE 


WinZip & Generic 


Source Safe 


File Maker Pro 


Zippers 


PC-Encrypt 


Lotus 1-2-3 


Q&A 






Quattro Pro 
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Software Description 4011-04 

MODEL 4011-04 - ACCESSDATA© DISTRIBUTED NETWORK ATTACK® 
(DNA® ) 

PUTTING IDLE TIME TO WORK 

Guaranteed recovery of lost passwords for MS Office 97/2000 products including Word and 
Excel; now includes Adobe Acrobat (PDF) file decryption! DNA puts idle time to work. 



Distributed Network Attack, or DNA, is a new approach to recovering password protected 
files. In the past, recoveries have been limited to the processing power of one machine. DNA 
uses the power of machines across the network or across the world to decrypt passwords. 



The DNA Server is installed in a central location where machines running DNA Client can 
access it over the network. DNA Manager coordinates the attack, assigning small portions of 
the key search to machines distributed throughout the network. DNA Client will run in the 
background, only taking unused processor time. 

FEATURES 

• Easy to read Statistics and Graphs 

• Add user dictionaries 

• Optimization for password attacks for specific languages 

• Customize user dictionaries 

• Stealth client installation functionality 

• Automatic Client update when updating the DNA Server 

• Control what clients work on certain jobs 

SUPPORTED FILE FORMATS 
Recovers and Decrypts 

• ARJ 

• MS Word and Excel (97 & 2000) 

• PDF 1 .4 and below 

Recovers a Password 

• Office XP 

• PGP Disk 4, 5, 6 

• Pkzip 

• RAR up to version 2.9 of WinRAR-WinZip 
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Software Description 4011-05 

MODEL 4011- 05 - ACCESSD AT A© REGISTRY VIEWER™ 

The Access Data Registry Viewer gives you the ability to view independent Windows registry 
files. Using the Registry Viewer provides access to the "Protected Storage System Provider" 
key, which contains e-mail and Internet passwords and settings. Easily generate reports 
containing valuable data from Registry keys of interest. The Registry Viewer includes a USB or 
parallel dongle to restrict unauthorized use. 

FEATURES 

Access and Decrypt Protected Storage Data 

• AutoComplete "form" data from Google, Yahoo, and more 

• Internet Explorer account login names and passwords 

• Outlook and Outlook Express account information including servers, users, and passwords 



View Independent Registry Files 

• Access User.dat, NTUser.dat, Sam, System, Security, Software, and Default files 

• Opens al versions of Windows Registry files 

• View files individually without reconstructing the full Registry 

Report Generation 

• HTML reporting capabilities 

• Easily integrates with Forensic Toolkit case reports 



Integrates with AccessData's Forensic Tools 

• Seamlessly load Registry files directly from the Forensic Toolkit into the Registry Viewer 

• Generate password lists for use with Password Recovery Toolkit 

• Access Data© Forensic Toolkit® 



The Access Data Forensic Toolkit® (FTK™) offers law enforcement and corporate security 
professionals the ability to perform complete and thorough computer forensic examinations. 
The FTK features powerful file filtering and search functionality. FTK's customizable filters 
allow you to sort through thousands of files to quickly find the evidence you need. FTK is 
recognized as the leading forensic tool to perform e-mail analysis. 



Easy to Use 

• View over 270 different file formats with Stelent's Outside in Viewer Technology 

• FTK Explorer allows you to quickly navigate through acquired images 

• Generate audit logs and case reports 

• Compatible with the Password Recovery Toolkit™ and Distributed Network Attack® . 
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Software Description 4011-05 

Advanced Searching 

• Full text indexing powered by dtSearch® yields instant text search results 

• Advanced searches for JPEG images and Internet text 

• Locates binary patterns using Live Search 

• Automatically recovers deleted files and partitions 

• Targets key files quickly by creating custom file filters. 

Supported File & Acquisition Formats 

• File formats include: NTFS, NTFS compressed, FAT 12/16/32, and Linux ext2 & ext3. 

• Image formats include: Encase, SMART, Snapback, Safe back (up to but not including v.3), 
and Linux DD. 

E-mail & Zip File Analysis 

• Supports: Outlook, Outlook Express, AOL, Netscape, Yahoo, EarthLink, Eudora, Hotmail, 
and MSN e-mail. 

• Views, searches, prints, and exports e-mail messages and attachments. 

• Recovers deleted and partially deleted e-mail. 

• Automatically extracts data from PKZIP, WinZip, WinRAR, GZIP, and TAR compressed files. 

Known File Filter™ (KFFTM) 

• Identifies and flags standard operating system and program files. 

• Identifies and flags known child pornography and other potential evidence files 

• Includes hash datasets from NIST and Hash keeper 

• Coming soon! Create your own custom hash sets. 

Registry Viewer™ 

• Accesses and decrypts protected storage data 

• Views independent registry files 

• Reports generation 

• Integrates with Access Data's forensic Tools 

• Access Data© One Year Subscription Features 

• Constant access to cutting edge technology. 

• No hassle with individual upgrades. 

• Web-updates for the Forensic Toolkit 
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1 1 - Contact Details 












If you would like further Information about ELAMAN, 
or would like to discuss a specific requirement or project, please contact us at: 

Elaman GmbH 
German Security Solutions 
Seitzstr. 23 
80538 Munich 
Germany 

Tel: +49-89-24 20 91 80 
Fax: +49-89-24 20 91 81 
info@elaman.de 
www.elaman.de 
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Overview of Elaman Catalogs 
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ABOUT US 

More than 10 years of experience in communication and security requirements for law 
enforcement agencies convinced us of the need to establish ELAMAN GmbH in 2004, 
specializing in security requirements for government and law enforcement authorities 
worldwide. 

ELAMAN GmbH, established in 2004, provides advanced integration systems, international 
consultancy and strategic technologies in Communications Systems, National Security, and 
Defense. The highly experienced international managers from different sectors focus to 
provide the solution to enable our customers to be more than adequately equipped to counter 
the threat of today and tomorrow. 

ELAMAN is a German based company with its headquarters in Munich/Germany. Our aim is to 
provide comprehensive security products and solutions, technical consultancy and services as 
well as professional training for our customers in Europe, the Middle East, Far East and Africa. 

• Technical Consulting 

• Professional Audio & Video Surveillance Products 

• VIP Protection & Specialists Detection 

• Monitoring- and Tracking Systems, Spectrum Monitoring 

• Counter (Anti-) Surveillance 

• Specialist Training 

• Intelligence Software 

ELAMAN is a leader in International marketing and trading, specializing in defense technology, 
communications and security. Through strategic partnerships with many leading international 
companies, we provide Law Enforcement Agencies alike with unique technology solutions. 

An essential element of our philosophy is the conviction that training and the understanding of 
products and technology are critical factors and major strengths in assuring successful security 
solutions. 

Our vast experience and services for well known companies, such as Siemens, Alcatel, 
Ericsson, Rohde & Schwarz, Spectronic, and others, has enabled us to handle even the most 
challenging and complex requirements and offer solutions that meet the relevant needs of 
Lawful Enforcement Agencies in the Middle East, Africa and Asia. 

Consequently, we have the expertise to offer solutions using state of the art technology and 
comprehensive functions for flawless operation, training and services. 

CONFIDENT RELATIONSHIP 

Confidentiality is essential in the business of security. ELAMAN can guarantee this as a 
German company and can furthermore be your sole interface with the manufacturers of 
security products and services. ELAMAN's business approach is to treat our customers as full 
partners in a relationship which is beneficial to both parties. 

This goal outwards to our customer will be represented by: 

Holger Rumscheidt as Managing Director and Eugen Fissl as Consultant and Partner. 
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